Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe

Overview

General Information

Sample name:SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Analysis ID:1467091
MD5:58a7d9b0cc94e95f3e89f6bb112c3275
SHA1:f3fd93fcdd0b7595e19e4c20731439e243a87426
SHA256:62404758252b994da1b60c819fa8cbf1b6a884cd001939479a90ba4c52585363
Tags:exe
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to query locales information (e.g. system language)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 95.0% probability
Machine Learning detection for sample
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeJoe Sandbox ML: detected
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dynam\Downloads\kdmapper-master\kdmapper-master\x64\Release\kdmapper.pdb33 source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: Binary string: C:\Users\dynam\Downloads\kdmapper-master\kdmapper-master\x64\Release\kdmapper.pdb source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAE268 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,CloseHandle,CloseHandle,terminate,0_2_00007FF712FAE268
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeString found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA2AE0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,VirtualFree,0_2_00007FF712FA2AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAD960 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,VirtualFree,_stricmp,VirtualFree,VirtualFree,_invalid_parameter_noinfo_noreturn,0_2_00007FF712FAD960
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA2AE0: NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,VirtualFree,0_2_00007FF712FA2AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA93300_2_00007FF712FA9330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAE2680_2_00007FF712FAE268
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA2AE00_2_00007FF712FA2AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA3CF00_2_00007FF712FA3CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAD9600_2_00007FF712FAD960
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA27A00_2_00007FF712FA27A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAC3C00_2_00007FF712FAC3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA18000_2_00007FF712FA1800
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FACA100_2_00007FF712FACA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: String function: 00007FF712FA5910 appears 83 times
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe, 00000000.00000000.1657624031.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameiQVW64.SYSH vs SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe, 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameiQVW64.SYSH vs SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeBinary or memory string: OriginalFilenameiQVW64.SYSH vs SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeBinary string: Unknown exceptionbad array new lengthstring too longbad cast\\\.\Nal[-] \Device\Nal is already in use.[<] Loading vulnerable driver, Name: [-] Can't find TEMP folder[-] Failed to create vulnerable driver file[-] Failed to register and start service for the vulnerable driver[-] Failed to load driver iqvw64e.sysntoskrnl.exe[-] Failed to get ntoskrnl.exe[-] Failed to ClearPiDDBCacheTable[-] Failed to ClearKernelHashBucketList[!] Failed to ClearMmUnloadedDrivers[<] Unloading vulnerable driver[!] Error dumping shit inside the disk[+] Vul driver data destroyed before unlink[-] Failed to translate virtual address 0x[-] Failed to map IO space of 0x[!] Failed to unmap IO space of physical address 0xMmAllocatePagesForMdl[!] Failed to find MmAlocatePagesForMdlMmMapLockedPagesSpecifyCache[!] Failed to find MmMapLockedPagesSpecifyCacheMmProtectMdlSystemAddress[!] Failed to find MmProtectMdlSystemAddressMmUnmapLockedPages[!] Failed to find MmUnmapLockedPagesMmFreePagesFromMdl[!] Failed to find MmFreePagesFromMdlExAllocatePoolWithTag[!] Failed to find ExAllocatePoolExFreePool[!] Failed to find device_object[!] Failed to find driver_object[!] Failed to find driver_section[!] Failed to find driver name[!] Failed to read driver name[!] Failed to write driver name length[+] MmUnloadedDrivers Cleaned: ExAcquireResourceExclusiveLite[!] Failed to find ExAcquireResourceExclusiveLiteExReleaseResourceLite[!] Failed to find ExReleaseResourceLiteRtlDeleteElementGenericTableAvl[!] Failed to find RtlDeleteElementGenericTableAvlRtlLookupElementGenericTableAvl[!] Failed to find RtlLookupElementGenericTableAvlxxxxxx????xxxxx????xxx????xxxxx????x????xx?x
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeBinary string: \Device\Nal
Source: classification engineClassification label: mal56.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6868:120:WilError_03
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeReversingLabs: Detection: 44%
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe "C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeSection loaded: kernel.appcore.dllJump to behavior
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\dynam\Downloads\kdmapper-master\kdmapper-master\x64\Release\kdmapper.pdb33 source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: Binary string: C:\Users\dynam\Downloads\kdmapper-master\kdmapper-master\x64\Release\kdmapper.pdb source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA2AE0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,VirtualFree,0_2_00007FF712FA2AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeAPI coverage: 2.4 %
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAE268 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,GetFileInformationByHandleEx,GetLastError,CloseHandle,terminate,CloseHandle,CloseHandle,terminate,0_2_00007FF712FAE268
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAE6B8 GetLastError,IsDebuggerPresent,OutputDebugStringW,0_2_00007FF712FAE6B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAE6B8 GetLastError,IsDebuggerPresent,OutputDebugStringW,0_2_00007FF712FAE6B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA2AE0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,VirtualFree,0_2_00007FF712FA2AE0
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FA9330 SetUnhandledExceptionFilter,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,__std_fs_code_page,memcmp,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,_invalid_parameter_noinfo_noreturn,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,0_2_00007FF712FA9330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAF4FC SetUnhandledExceptionFilter,0_2_00007FF712FAF4FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAF350 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF712FAF350
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAEBB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF712FAEBB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: GetLocaleInfoEx,FormatMessageA,0_2_00007FF712FADFB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exeCode function: 0_2_00007FF712FAF568 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF712FAF568

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Process Injection		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory3
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDS12
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe45%ReversingLabs
SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://crl.thawte.com/ThawteTimestampingCA.crl0SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exefalse
  • URL Reputation: safe
unknown
http://ocsp.thawte.com0SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exefalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467091
Start date and time:2024-07-03 18:06:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 54s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:2
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Detection:MAL
Classification:mal56.winEXE@2/1@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 4
  • Number of non-executed functions: 66
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Warnings

  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File
Process:C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
File Type:ASCII text, with CRLF, CR line terminators
Category:dropped
Size (bytes):97
Entropy (8bit):4.68946445647071
Encrypted:false
SSDEEP:3:ytoICArEE0IEVq4MILAAzI1MCJEdMgxGzin:wRCA5CVq4FAAzI1M5VGzin
MD5:293C14E3E6CE8BCF759BCB6365C0D4FB
SHA1:0D7B836D72608CD666F00FFFAC677B8BFB660161
SHA-256:3C5C212D5DC08B830238A0B4B2B46B07EEA0847F1C05CC658F27F4DC44BE384C
SHA-512:0612C0976E7FBFF0CB8D311370EB1C031E61EE5B5AEB14C5A965F2B87B1E8BE4E401F7213A83B299E0E2C787CEFF7FFC7AC3B91D20AC6DE1A537D5EC952A0A5E
Malicious:false
Reputation:moderate, very likely benign file
Preview:......[!] Incorrect Usage!..[+] Usage: kdmapper.exe [--free][--mdl][--PassAllocationPtr] driver..

Static File Info

General

File type:PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):6.137276392331251
TrID:
  • Win64 Executable Console (202006/5) 92.65%
  • Win64 Executable (generic) (12005/4) 5.51%
  • Generic Win/DOS Executable (2004/3) 0.92%
  • DOS Executable Generic (2002/1) 0.92%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
File size:136'192 bytes
MD5:58a7d9b0cc94e95f3e89f6bb112c3275
SHA1:f3fd93fcdd0b7595e19e4c20731439e243a87426
SHA256:62404758252b994da1b60c819fa8cbf1b6a884cd001939479a90ba4c52585363
SHA512:8271862b5644152494f4e5e9c195a7a3f43c6bf535bab9623c55c9d86617bad0d79e9cf5382446df994b798dd14768e31a30e53a926fefdf4e2e033fb0db12b9
SSDEEP:3072:aNK7sxZHzwOMz1G6yLB40GrXmJTQSaMm5/6yzwRGrT:asYxZRj1q0WlEG
TLSH:ABD33B5763A510A8E5B7E2BCDAB64612E7B27C140774D7CF0350813A0F627E1AE3EB61
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O........................................%...........M...............0^......0^x.....0^......Rich...........................

File Icon

Icon Hash:90cececece8e8eb0

Static PE Info

General

Entrypoint:0x14000f0b4
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows cui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x6627EBF4 [Tue Apr 23 17:12:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:183978a44ba0462e201da2bf5312bb94

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBFB8B946D0h
dec eax
add esp, 28h
jmp 00007FBFB8B94097h
int3
int3
retn 0000h
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FBFB8B94232h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FBFB8B94235h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FBFB8B9422Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FBFB8B9388Eh
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov edx, edx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor edx, 49656E69h
inc esp
mov ecx, ebx
mov esi, eax
xor ecx, ecx

Rich Headers

Programming Language:
  • [IMP] VS2008 SP1 build 30729

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x1f5a80x140.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x240000x1e8.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x230000xccc.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x250000x100.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x1cad00x70.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x1cb800x28.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1c9900x140.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x110000x5b8.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000xf1f80xf200faf22897ec01ba2a98e9f0ea2393a2d7False0.5015334452479339data6.239153652132455IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x110000x104340x106009305ffd0bada176c4f2cb7aff2f44a84False0.4282711116412214data5.775899677761921IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x220000xd600x600bf62bb49a8b6002a5206c2e3a19f8bfbFalse0.205078125data3.499545685261346IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata0x230000xccc0xe001ff31f699355428c811535cdd5d43bf6False0.45703125data4.609010788641389IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x240000x1e80x200971a6bbdae0e0e43dfd18434202d1eecFalse0.5390625data4.772037401703051IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x250000x1000x200d5a8347d20875382250ff5d6b90054f1False0.435546875data3.175024014376331IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_MANIFEST0x240600x188XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5892857142857143

Imports

DLLImport
KERNEL32.dllGetCurrentThreadId, GetModuleHandleA, GetLastError, CloseHandle, CreateFileW, GetProcAddress, DeleteCriticalSection, GetCurrentProcessId, SetUnhandledExceptionFilter, GetTempPathW, FormatMessageA, GetLocaleInfoEx, InitializeCriticalSectionEx, VirtualAlloc, DeviceIoControl, VirtualFree, FindClose, FindFirstFileW, GetFileAttributesExW, AreFileApisANSI, GetModuleHandleW, GetFileInformationByHandleEx, WideCharToMultiByte, IsDebuggerPresent, OutputDebugStringW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, LocalFree
ADVAPI32.dllRegCloseKey, RegDeleteTreeW, RegCreateKeyW, RegOpenKeyW, RegSetKeyValueW
MSVCP140.dll?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?widen@?$ctype@_W@std@@QEBA_WD@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Winerror_map@std@@YAHH@Z, ?_Syserror_map@std@@YAPEBDH@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ??1_Lockit@std@@QEAA@XZ, ??0_Lockit@std@@QEAA@H@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?uncaught_exception@std@@YA_NXZ, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?id@?$ctype@_W@std@@2V0locale@2@A, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
ntdll.dllNtQuerySystemInformation, RtlInitUnicodeString
VCRUNTIME140_1.dll__CxxFrameHandler4
VCRUNTIME140.dll_CxxThrowException, __C_specific_handler, memset, __current_exception_context, __std_exception_copy, __std_exception_destroy, memcmp, __current_exception, memmove, __std_terminate, memcpy
api-ms-win-crt-stdio-l1-1-0.dllfsetpos, ungetc, fclose, fputc, fread, _fseeki64, setvbuf, fgetpos, fwrite, __p__commode, _set_fmode, fgetc, fflush, _get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0.dllmalloc, _callnewh, _set_new_mode, free
api-ms-win-crt-utility-l1-1-0.dllrand, srand
api-ms-win-crt-filesystem-l1-1-0.dll_lock_file, _wremove, _unlock_file
api-ms-win-crt-string-l1-1-0.dll_stricmp, _wcsicmp
api-ms-win-crt-time-l1-1-0.dll_time64
api-ms-win-crt-runtime-l1-1-0.dllexit, _initterm_e, _configure_wide_argv, _initterm, __p___argc, _get_initial_wide_environment, _seh_filter_exe, _cexit, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _set_app_type, _register_thread_local_exe_atexit_callback, _c_exit, terminate, _initialize_wide_environment, system, __p___wargv, _invalid_parameter_noinfo_noreturn, _exit
api-ms-win-crt-locale-l1-1-0.dll___lc_codepage_func, _configthreadlocale
api-ms-win-crt-math-l1-1-0.dll__setusermatherr

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:12:06:58
Start date:03/07/2024
Path:C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe
Wow64 process (32bit):false
Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.W64.Gamehack.DF.gen.Eldorado.1858.10572.exe"
Imagebase:0x7ff712fa0000
File size:136'192 bytes
MD5 hash:58A7D9B0CC94E95F3E89F6BB112C3275
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

General

Target ID:1
Start time:12:06:58
Start date:03/07/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff7699e0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:2.2%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:18.9%
    Total number of Nodes:1929
    Total number of Limit Nodes:3
    execution_graph 6266 7ff712fa4a20 6267 7ff712fa4a39 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J 6266->6267 6268 7ff712fa4a48 6266->6268 6267->6268 6269 7ff712fa4ac9 6268->6269 6270 7ff712fa4aa9 6268->6270 6271 7ff712fa4a7c memmove 6268->6271 6270->6269 6272 7ff712fa4ab5 fwrite 6270->6272 6271->6269 6271->6270 6272->6269 6433 7ff712fa87a0 6434 7ff712fa87d1 ?_Winerror_map@std@@YAHH 6433->6434 6435 7ff712fa87b5 6433->6435 6436 7ff712fa87dd 6434->6436 6273 7ff712fb011e ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA 6274 7ff712faef1c 6278 7ff712faf4fc SetUnhandledExceptionFilter 6274->6278 6279 7ff712fa5230 6280 7ff712fa5243 6279->6280 6281 7ff712fa523c _lock_file 6279->6281 6281->6280 6282 7ff712fa4830 6283 7ff712fa4885 6282->6283 6284 7ff712fa4866 6282->6284 6286 7ff712fae7b0 8 API calls 6283->6286 6285 7ff712fa55f0 10 API calls 6284->6285 6287 7ff712fa486b 6285->6287 6288 7ff712fa48fb 6286->6288 6287->6283 6289 7ff712fa486f fsetpos 6287->6289 6289->6283 6290 7ff712fa1030 __std_exception_copy 6291 7ff712fa4730 6292 7ff712fa4753 6291->6292 6293 7ff712fa476f setvbuf 6292->6293 6294 7ff712fa47ed 6292->6294 6293->6294 6295 7ff712fa477d ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 6293->6295 6297 7ff712fae7b0 8 API calls 6294->6297 6295->6294 6296 7ff712fa479f _get_stream_buffer_pointers 6295->6296 6296->6294 6298 7ff712fa481c 6297->6298 6437 7ff712fa55b0 ?uncaught_exception@std@ 6438 7ff712fa55c3 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 6437->6438 6439 7ff712fa55cd 6437->6439 6438->6439 6301 7ff712fabc30 6302 7ff712fabca0 17 API calls 6301->6302 6303 7ff712fabc42 6302->6303 6304 7ff712fabc70 6303->6304 6305 7ff712fabc91 _invalid_parameter_noinfo_noreturn 6303->6305 6440 7ff712faf0b4 6443 7ff712faf568 6440->6443 6444 7ff712faf0bd 6443->6444 6445 7ff712faf58b GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 6443->6445 6445->6444 6306 7ff712fa7c40 6307 7ff712fa7ce5 6306->6307 6308 7ff712fa7c8c 6306->6308 6309 7ff712fa7d48 6307->6309 6310 7ff712fa7ced memmove 6307->6310 6308->6307 6314 7ff712fa7c91 memmove 6308->6314 6313 7ff712fa7e47 6309->6313 6317 7ff712fa7d61 6309->6317 6311 7ff712fa7d31 memmove 6310->6311 6312 7ff712fa7d2e 6310->6312 6316 7ff712fa7e2f 6311->6316 6312->6311 6332 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6313->6332 6314->6316 6319 7ff712fa7e4c 6317->6319 6321 7ff712fa7dde 6317->6321 6322 7ff712fa7dbc 6317->6322 6320 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 6319->6320 6323 7ff712fa7e52 6320->6323 6324 7ff712fa7dc9 memmove 6321->6324 6326 7ff712fae8f8 std::_Facet_Register 3 API calls 6321->6326 6325 7ff712fae8f8 std::_Facet_Register 3 API calls 6322->6325 6330 7ff712fa7e18 6324->6330 6331 7ff712fa7e1b memmove 6324->6331 6328 7ff712fa7dc4 6325->6328 6326->6324 6328->6324 6329 7ff712fa7dd7 _invalid_parameter_noinfo_noreturn 6328->6329 6329->6321 6330->6331 6331->6316 6333 7ff712fa4c40 6334 7ff712fa4c77 6333->6334 6336 7ff712fa4cf2 fgetc 6334->6336 6341 7ff712fa4c87 6334->6341 6343 7ff712fa4d0e 6334->6343 6335 7ff712fae7b0 8 API calls 6337 7ff712fa4ee6 6335->6337 6336->6341 6338 7ff712fa4d29 fgetc 6342 7ff712fa4e2f 6338->6342 6338->6343 6339 7ff712fa4d75 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD 6339->6343 6340 7ff712fa7ac0 6 API calls 6340->6339 6341->6335 6342->6341 6344 7ff712fa4ecc _invalid_parameter_noinfo_noreturn 6342->6344 6343->6338 6343->6339 6343->6340 6343->6342 6345 7ff712fa4de3 memmove 6343->6345 6346 7ff712fa4e47 6343->6346 6344->6341 6345->6338 6346->6342 6347 7ff712fa4e70 ungetc 6346->6347 6347->6342 6347->6346 6446 7ff712faecc0 6449 7ff712faecd4 IsProcessorFeaturePresent 6446->6449 6450 7ff712faeceb 6449->6450 6455 7ff712faed70 RtlCaptureContext RtlLookupFunctionEntry 6450->6455 6456 7ff712faecff 6455->6456 6457 7ff712faeda0 RtlVirtualUnwind 6455->6457 6458 7ff712faebb8 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 6456->6458 6457->6456 6459 7ff712fafac0 6460 7ff712fafad3 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA 6459->6460 6461 7ff712fafae8 6459->6461 6460->6461 4372 7ff712faef38 4373 7ff712faef51 __scrt_initialize_crt 4372->4373 4374 7ff712faf08f 4373->4374 4375 7ff712faef59 __scrt_acquire_startup_lock 4373->4375 4468 7ff712faf350 IsProcessorFeaturePresent 4374->4468 4377 7ff712faf099 4375->4377 4383 7ff712faef77 __scrt_release_startup_lock 4375->4383 4378 7ff712faf350 9 API calls 4377->4378 4379 7ff712faf0a4 4378->4379 4381 7ff712faf0ac _exit 4379->4381 4380 7ff712faef9c 4382 7ff712faf022 _get_initial_wide_environment __p___wargv __p___argc 4392 7ff712fa9330 SetUnhandledExceptionFilter 4382->4392 4383->4380 4383->4382 4386 7ff712faf01a _register_thread_local_exe_atexit_callback 4383->4386 4385 7ff712faf044 4466 7ff712faf4a8 GetModuleHandleW 4385->4466 4386->4382 4389 7ff712faf04f 4390 7ff712faf054 _cexit 4389->4390 4391 7ff712faf059 4389->4391 4390->4391 4391->4380 4394 7ff712fa938c 4392->4394 4403 7ff712fa9429 4392->4403 4393 7ff712fa9584 4396 7ff712fa95b8 4393->4396 4399 7ff712fa5910 9 API calls 4393->4399 4395 7ff712fa93b0 _wcsicmp 4394->4395 4394->4403 4408 7ff712fa93f0 _wcsicmp 4394->4408 4395->4394 4397 7ff712fa95e0 4396->4397 4402 7ff712fa5910 9 API calls 4396->4402 4406 7ff712fa5910 9 API calls 4397->4406 4423 7ff712fa9607 4397->4423 4398 7ff712fa9460 _wcsicmp 4398->4403 4400 7ff712fa95a8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4399->4400 4400->4396 4401 7ff712fa9510 _wcsicmp 4404 7ff712fa94d9 4401->4404 4405 7ff712fa95d0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4402->4405 4403->4398 4403->4404 4411 7ff712fa94a0 _wcsicmp 4403->4411 4404->4393 4404->4401 4413 7ff712fa9550 _wcsicmp 4404->4413 4405->4397 4410 7ff712fa95f7 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4406->4410 4407 7ff712fa98d1 4474 7ff712fa5910 4407->4474 4408->4394 4410->4423 4411->4403 4413->4404 4414 7ff712fa5910 9 API calls 4415 7ff712fa9907 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4414->4415 4416 7ff712fa9917 4415->4416 4509 7ff712fae7b0 4416->4509 4419 7ff712fa7880 7 API calls 4419->4423 4423->4407 4423->4419 4424 7ff712fa9949 _invalid_parameter_noinfo_noreturn 4423->4424 4425 7ff712fa9950 _invalid_parameter_noinfo_noreturn 4423->4425 4426 7ff712fa995e 4423->4426 4427 7ff712fa9957 _invalid_parameter_noinfo_noreturn 4423->4427 4488 7ff712fae050 ___lc_codepage_func 4423->4488 4491 7ff712fa9f90 4423->4491 4424->4425 4425->4427 4426->4407 4428 7ff712fa996b 4426->4428 4427->4426 4518 7ff712fa7880 4428->4518 4431 7ff712fa99a4 4432 7ff712fa7880 7 API calls 4431->4432 4433 7ff712fa99d3 4432->4433 4535 7ff712fae268 4433->4535 4435 7ff712fa9d77 4772 7ff712fa91e0 4435->4772 4436 7ff712fa99fa 4436->4435 4437 7ff712fa9ac8 4436->4437 4440 7ff712fa9ab4 _invalid_parameter_noinfo_noreturn 4436->4440 4443 7ff712fa5910 9 API calls 4437->4443 4458 7ff712fa9b22 4437->4458 4440->4436 4442 7ff712fa9dc6 4442->4385 4444 7ff712fa9ae8 4443->4444 4571 7ff712fa7fa0 4444->4571 4445 7ff712fa9de1 _invalid_parameter_noinfo_noreturn 4449 7ff712fa5910 9 API calls 4450 7ff712fa9b11 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4449->4450 4450->4458 4451 7ff712fa9b65 _invalid_parameter_noinfo_noreturn 4451->4458 4453 7ff712fa5910 9 API calls 4453->4458 4455 7ff712fa9c33 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4741 7ff712fa1d20 4455->4741 4456 7ff712fa1d20 90 API calls 4456->4458 4458->4416 4458->4451 4458->4453 4458->4455 4458->4456 4459 7ff712fa7fa0 9 API calls 4458->4459 4460 7ff712fa5910 9 API calls 4458->4460 4461 7ff712fa5910 9 API calls 4458->4461 4464 7ff712fa9d16 _invalid_parameter_noinfo_noreturn 4458->4464 4465 7ff712fa9d61 4458->4465 4585 7ff712fa1800 _time64 GetCurrentThreadId srand CreateFileW 4458->4585 4646 7ff712fae8f8 4458->4646 4655 7ff712fad660 memset 4458->4655 4673 7ff712faab80 4458->4673 4459->4455 4462 7ff712fa9cb5 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4460->4462 4463 7ff712fa9cd8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4461->4463 4462->4458 4463->4458 4464->4458 4465->4416 4467 7ff712faf04b 4466->4467 4467->4379 4467->4389 4469 7ff712faf376 4468->4469 4470 7ff712faf384 memset RtlCaptureContext RtlLookupFunctionEntry 4469->4470 4471 7ff712faf3fa memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 4470->4471 4472 7ff712faf3be RtlVirtualUnwind 4470->4472 4473 7ff712faf47e 4471->4473 4472->4471 4473->4377 4475 7ff712fa5940 ?good@ios_base@std@ 4474->4475 4477 7ff712fa59c2 4475->4477 4478 7ff712fa5994 4475->4478 4479 7ff712fa59cc ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 4477->4479 4482 7ff712fa5a1f ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J 4477->4482 4485 7ff712fa59f6 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 4477->4485 4478->4477 4480 7ff712fa59aa ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 ?good@ios_base@std@ 4478->4480 4483 7ff712fa5aae ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 4479->4483 4486 7ff712fa5ab8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4479->4486 4480->4477 4482->4479 4484 7ff712fa5a3c 4482->4484 4483->4486 4484->4479 4487 7ff712fa5a45 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 4484->4487 4485->4477 4485->4479 4486->4414 4487->4479 4487->4484 4489 7ff712fae070 4488->4489 4490 7ff712fae063 AreFileApisANSI 4488->4490 4489->4423 4490->4489 4492 7ff712fa9fe0 4491->4492 4493 7ff712fa9783 memcmp 4491->4493 4508 7ff712faa0d1 4492->4508 4789 7ff712fae078 4492->4789 4493->4423 4497 7ff712faa0d7 4498 7ff712fa8840 11 API calls 4497->4498 4499 7ff712faa0e3 4498->4499 4500 7ff712faa073 4799 7ff712faa3a0 4500->4799 4501 7ff712faa04c memset 4503 7ff712faa020 4501->4503 4505 7ff712fae078 __std_fs_convert_wide_to_narrow 5 API calls 4503->4505 4506 7ff712faa0a0 4505->4506 4506->4493 4817 7ff712fa8840 4506->4817 4821 7ff712fa8570 4508->4821 4510 7ff712fae7b9 4509->4510 4511 7ff712fa9928 4510->4511 4512 7ff712faebec IsProcessorFeaturePresent 4510->4512 4511->4385 4513 7ff712faec04 4512->4513 4836 7ff712faede0 RtlCaptureContext 4513->4836 4519 7ff712fa78a6 4518->4519 4520 7ff712fa79a7 4518->4520 4521 7ff712fa78b9 memmove 4519->4521 4523 7ff712fa78df 4519->4523 4841 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4520->4841 4521->4431 4524 7ff712fa79ac 4523->4524 4525 7ff712fa7960 4523->4525 4527 7ff712fa793e 4523->4527 4526 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 4524->4526 4528 7ff712fa794b memmove 4525->4528 4531 7ff712fae8f8 std::_Facet_Register 3 API calls 4525->4531 4529 7ff712fa79b2 4526->4529 4530 7ff712fae8f8 std::_Facet_Register 3 API calls 4527->4530 4528->4431 4533 7ff712fa7946 4530->4533 4531->4528 4533->4528 4534 7ff712fa7959 _invalid_parameter_noinfo_noreturn 4533->4534 4534->4525 4537 7ff712fae2aa 4535->4537 4536 7ff712fae7b0 8 API calls 4538 7ff712fae555 4536->4538 4540 7ff712fae30b GetFileAttributesExW 4537->4540 4543 7ff712fae370 4537->4543 4548 7ff712fae2b3 4537->4548 4538->4436 4542 7ff712fae31f GetLastError 4540->4542 4540->4543 4546 7ff712fae32e FindFirstFileW 4542->4546 4542->4548 4543->4548 4842 7ff712fae590 CreateFileW 4543->4842 4544 7ff712fae40e 4549 7ff712fae4bf 4544->4549 4550 7ff712fae41d GetFileInformationByHandleEx 4544->4550 4545 7ff712fae3ee 4547 7ff712fae3f9 CloseHandle 4545->4547 4545->4548 4551 7ff712fae342 GetLastError 4546->4551 4552 7ff712fae34d FindClose 4546->4552 4547->4548 4553 7ff712fae580 terminate 4547->4553 4548->4536 4554 7ff712fae4da GetFileInformationByHandleEx 4549->4554 4555 7ff712fae51a 4549->4555 4556 7ff712fae460 4550->4556 4557 7ff712fae437 GetLastError 4550->4557 4551->4548 4552->4543 4553->4548 4554->4555 4558 7ff712fae4f0 GetLastError 4554->4558 4560 7ff712fae531 4555->4560 4561 7ff712fae56d 4555->4561 4556->4549 4566 7ff712fae481 GetFileInformationByHandleEx 4556->4566 4557->4548 4559 7ff712fae445 CloseHandle 4557->4559 4558->4548 4563 7ff712fae502 CloseHandle 4558->4563 4559->4548 4564 7ff712fae452 terminate 4559->4564 4560->4548 4565 7ff712fae537 CloseHandle 4560->4565 4561->4548 4562 7ff712fae573 CloseHandle 4561->4562 4562->4548 4562->4553 4563->4548 4568 7ff712fae513 terminate 4563->4568 4564->4548 4565->4548 4565->4553 4566->4549 4567 7ff712fae49d GetLastError 4566->4567 4567->4548 4569 7ff712fae4ab CloseHandle 4567->4569 4568->4555 4569->4548 4570 7ff712fae4b8 terminate 4569->4570 4570->4549 4574 7ff712fa7fdc ?good@ios_base@std@ 4571->4574 4573 7ff712fa8015 4575 7ff712fa8043 4573->4575 4577 7ff712fa802b ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 ?good@ios_base@std@ 4573->4577 4574->4573 4574->4575 4576 7ff712fa804d ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 4575->4576 4579 7ff712fa80a4 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J 4575->4579 4582 7ff712fa8077 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 4575->4582 4580 7ff712fa812f ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 4576->4580 4581 7ff712fa8139 4576->4581 4577->4575 4579->4576 4583 7ff712fa8094 4579->4583 4580->4581 4581->4449 4582->4575 4582->4583 4583->4576 4584 7ff712fa80c6 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 4583->4584 4584->4576 4584->4583 4586 7ff712fa18c1 rand 4585->4586 4587 7ff712fa1889 CloseHandle 4585->4587 4589 7ff712fa1971 4586->4589 4590 7ff712fa1926 4586->4590 4588 7ff712fa5910 9 API calls 4587->4588 4591 7ff712fa18a5 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4588->4591 4593 7ff712fa5910 9 API calls 4589->4593 4592 7ff712fa1940 rand 4590->4592 4616 7ff712fa1ce8 4591->4616 4592->4589 4592->4592 4596 7ff712fa1984 4593->4596 4594 7ff712fae7b0 8 API calls 4595 7ff712fa1cff 4594->4595 4595->4458 4597 7ff712fa7fa0 9 API calls 4596->4597 4598 7ff712fa19ab ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4597->4598 4599 7ff712fa19fc 4598->4599 4600 7ff712fa19c7 4598->4600 4602 7ff712fa1a3c _wremove memset 4599->4602 4622 7ff712fa1a14 4599->4622 4600->4599 4601 7ff712fa19f5 _invalid_parameter_noinfo_noreturn 4600->4601 4601->4599 4845 7ff712fa52c0 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 4602->4845 4605 7ff712fa5910 9 API calls 4608 7ff712fa1a27 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4605->4608 4606 7ff712fa1aea 4610 7ff712fa56e0 12 API calls 4606->4610 4607 7ff712fa1aae 4850 7ff712fa56e0 4607->4850 4615 7ff712fa1ca1 4608->4615 4612 7ff712fa1aef 4610->4612 4611 7ff712fa1ab3 4613 7ff712fa1ad5 4611->4613 4614 7ff712fa1ab8 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4611->4614 4617 7ff712fa1b11 4612->4617 4618 7ff712fa1af4 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4612->4618 4856 7ff712fa2050 4613->4856 4614->4613 4615->4616 4623 7ff712fa1ce1 _invalid_parameter_noinfo_noreturn 4615->4623 4616->4594 4620 7ff712fa2050 15 API calls 4617->4620 4618->4617 4621 7ff712fa1b1a 4620->4621 4860 7ff712facf50 4621->4860 4622->4605 4623->4616 4626 7ff712fa1b28 4628 7ff712fa5910 9 API calls 4626->4628 4627 7ff712fa1b67 CreateFileW 4629 7ff712fa1ba8 4627->4629 4645 7ff712fa1c2e 4627->4645 4630 7ff712fa1b3b ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z _wremove 4628->4630 4897 7ff712fa79c0 4629->4897 4630->4615 4632 7ff712fa5910 9 API calls 4634 7ff712fa1c89 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4632->4634 4633 7ff712fa1bd0 4914 7ff712fad960 NtQuerySystemInformation 4633->4914 4636 7ff712fa1d20 90 API calls 4634->4636 4636->4615 4638 7ff712fa1c1d 4638->4645 4931 7ff712fa3300 4638->4931 4640 7ff712fa1c16 _invalid_parameter_noinfo_noreturn 4640->4638 4645->4615 4645->4632 4647 7ff712fae912 malloc 4646->4647 4648 7ff712fae91c 4647->4648 4650 7ff712fae903 4647->4650 4648->4458 4649 7ff712fae922 4651 7ff712fae92d 4649->4651 5513 7ff712faf314 4649->5513 4650->4647 4650->4649 4653 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 4651->4653 4654 7ff712fae933 4653->4654 4656 7ff712fad6b0 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 4655->4656 4657 7ff712fad6ad 4655->4657 4658 7ff712fa57a0 24 API calls 4656->4658 4657->4656 4659 7ff712fad75e 4658->4659 4660 7ff712fad782 ??7ios_base@std@ 4659->4660 4661 7ff712fad763 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4659->4661 4662 7ff712fad7c5 4660->4662 4672 7ff712fad7be 4660->4672 4661->4660 5517 7ff712fadbd0 4662->5517 4667 7ff712fa56e0 12 API calls 4669 7ff712fad83d 4667->4669 4671 7ff712fad842 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4669->4671 4669->4672 4671->4672 5530 7ff712fad8a0 4672->5530 4674 7ff712faabf1 4673->4674 4675 7ff712faabd3 4673->4675 4676 7ff712fa5910 9 API calls 4674->4676 4675->4674 4677 7ff712faabfd VirtualAlloc 4675->4677 4678 7ff712fab054 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4676->4678 4679 7ff712faac20 4677->4679 4704 7ff712faafaa 4677->4704 4678->4704 4680 7ff712faac40 4679->4680 4681 7ff712faac58 4679->4681 5551 7ff712faa6e0 4680->5551 4685 7ff712fae880 3 API calls 4681->4685 4686 7ff712faad57 4681->4686 4694 7ff712faad26 4681->4694 4682 7ff712fae7b0 8 API calls 4684 7ff712fab072 4682->4684 4684->4458 4689 7ff712faac8e 4685->4689 4690 7ff712fa5910 9 API calls 4686->4690 4687 7ff712faad34 4691 7ff712fa5910 9 API calls 4687->4691 4688 7ff712faad67 5621 7ff712fa6680 4688->5621 4689->4694 4699 7ff712fa79c0 7 API calls 4689->4699 4695 7ff712faaf7d ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z VirtualFree 4690->4695 4696 7ff712faad47 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4691->4696 4693 7ff712fa5910 9 API calls 4698 7ff712faadb0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z memmove 4693->4698 4694->4687 4694->4688 4700 7ff712fa2660 54 API calls 4695->4700 4696->4686 4697 7ff712faac4c 4697->4686 4697->4693 4701 7ff712faae1b 4698->4701 4702 7ff712faadeb 4698->4702 4703 7ff712faacc0 4699->4703 4700->4704 4705 7ff712fa5910 9 API calls 4701->4705 4702->4701 4707 7ff712faadf9 memmove 4702->4707 4706 7ff712fa27a0 24 API calls 4703->4706 4704->4682 4708 7ff712faae40 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K 4705->4708 4709 7ff712faacd4 4706->4709 4707->4702 4710 7ff712fa5910 9 API calls 4708->4710 4711 7ff712faad14 4709->4711 4715 7ff712faad0d _invalid_parameter_noinfo_noreturn 4709->4715 4713 7ff712faae6b ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4710->4713 5620 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 4711->5620 5647 7ff712fabe10 4713->5647 4715->4711 4718 7ff712faae96 5657 7ff712fabf60 4718->5657 4722 7ff712faaead 4722->4686 4723 7ff712fa2110 9 API calls 4722->4723 4724 7ff712faaed3 4723->4724 4724->4686 4725 7ff712fa5910 9 API calls 4724->4725 4726 7ff712faaefd ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4725->4726 5709 7ff712fa92f0 4726->5709 4728 7ff712faaf31 4728->4686 5712 7ff712fab550 4728->5712 4731 7ff712faafaf 4732 7ff712fa5910 9 API calls 4731->4732 4733 7ff712faafd0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4732->4733 4734 7ff712fab001 4733->4734 4735 7ff712fab02b VirtualFree 4733->4735 4736 7ff712fab020 4734->4736 5738 7ff712fa2400 4734->5738 4735->4704 4738 7ff712fa2660 54 API calls 4736->4738 4738->4735 4739 7ff712fab015 5756 7ff712fa2530 4739->5756 4742 7ff712fa5910 9 API calls 4741->4742 4743 7ff712fa1d66 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4742->4743 4744 7ff712fa1d80 CloseHandle 4743->4744 4745 7ff712fa1d89 4743->4745 4744->4745 6093 7ff712fad3a0 GetModuleHandleA 4745->6093 4748 7ff712fa1ddf 4749 7ff712fa1de8 4748->4749 4752 7ff712fa1df9 memset 4748->4752 4751 7ff712fae7b0 8 API calls 4749->4751 4750 7ff712fa1dd8 _invalid_parameter_noinfo_noreturn 4750->4748 4753 7ff712fa202f 4751->4753 4754 7ff712fa52c0 29 API calls 4752->4754 4753->4458 4755 7ff712fa1e27 rand 4754->4755 4756 7ff712fa1e67 4755->4756 4757 7ff712fa1e71 rand 4756->4757 4758 7ff712fa1ea4 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J ??7ios_base@std@ 4756->4758 4757->4757 4757->4758 4759 7ff712fa1ed7 4758->4759 4760 7ff712fa5910 9 API calls 4759->4760 4761 7ff712fa1ee3 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4760->4761 4762 7ff712fa56e0 12 API calls 4761->4762 4763 7ff712fa1efd 4762->4763 4764 7ff712fa1f20 4763->4764 4765 7ff712fa1f02 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4763->4765 4766 7ff712fa1f28 _wremove 4764->4766 4765->4764 4767 7ff712fa1f80 4766->4767 4768 7ff712fa1fb7 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA 4767->4768 4769 7ff712fa56e0 12 API calls 4767->4769 4768->4749 4770 7ff712fa1fe3 4768->4770 4769->4768 4770->4749 4771 7ff712fa2011 _invalid_parameter_noinfo_noreturn 4770->4771 4771->4749 6122 7ff712fa54a0 4772->6122 4776 7ff712fa9227 _CxxThrowException 4777 7ff712fa92a6 4776->4777 4778 7ff712fa924e 4776->4778 4780 7ff712fa5910 9 API calls 4777->4780 4778->4777 4779 7ff712fa9254 4778->4779 4781 7ff712fa5910 9 API calls 4779->4781 4782 7ff712fa92b9 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4780->4782 4783 7ff712fa9267 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX 4781->4783 4784 7ff712fa92d5 4782->4784 4785 7ff712fa92da 4782->4785 4786 7ff712fa5910 9 API calls 4783->4786 4787 7ff712fa1d20 90 API calls 4784->4787 4785->4442 4785->4445 4788 7ff712fa9286 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K 4786->4788 4787->4785 4788->4782 4790 7ff712fae09f 4789->4790 4791 7ff712fae0f6 WideCharToMultiByte 4789->4791 4790->4791 4792 7ff712fae0a7 WideCharToMultiByte 4790->4792 4793 7ff712fae127 4791->4793 4792->4793 4794 7ff712faa005 4792->4794 4795 7ff712fae133 4793->4795 4796 7ff712fae12b GetLastError 4793->4796 4794->4497 4794->4500 4794->4501 4794->4503 4795->4794 4797 7ff712fae140 WideCharToMultiByte 4795->4797 4796->4795 4797->4794 4798 7ff712fae16d GetLastError 4797->4798 4798->4794 4800 7ff712faa51a 4799->4800 4801 7ff712faa3cd 4799->4801 4825 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4800->4825 4802 7ff712faa42d 4801->4802 4805 7ff712faa420 4801->4805 4806 7ff712faa459 4801->4806 4807 7ff712fae8f8 std::_Facet_Register 3 API calls 4802->4807 4804 7ff712faa51f 4826 7ff712fa1130 4804->4826 4805->4802 4805->4804 4808 7ff712faa442 4806->4808 4811 7ff712fae8f8 std::_Facet_Register 3 API calls 4806->4811 4807->4808 4810 7ff712faa4d5 _invalid_parameter_noinfo_noreturn 4808->4810 4813 7ff712faa489 memmove memset 4808->4813 4814 7ff712faa4dc memmove memset 4808->4814 4810->4814 4811->4808 4812 7ff712faa525 4815 7ff712faa4b3 4813->4815 4816 7ff712faa4c8 4813->4816 4814->4816 4815->4810 4815->4816 4816->4503 4818 7ff712fa8850 4817->4818 4829 7ff712fa8480 4818->4829 4822 7ff712fa857e 4821->4822 4823 7ff712fa8480 10 API calls 4822->4823 4824 7ff712fa8595 _CxxThrowException __std_exception_copy 4823->4824 4824->4497 4827 7ff712fa113e Concurrency::cancel_current_task 4826->4827 4828 7ff712fa114f __std_exception_copy 4827->4828 4828->4812 4830 7ff712fa84b6 __std_exception_copy 4829->4830 4831 7ff712fa8505 4830->4831 4832 7ff712fa8535 4830->4832 4831->4832 4834 7ff712fa852e _invalid_parameter_noinfo_noreturn 4831->4834 4833 7ff712fae7b0 8 API calls 4832->4833 4835 7ff712fa855b _CxxThrowException 4833->4835 4834->4832 4837 7ff712faedfa RtlLookupFunctionEntry 4836->4837 4838 7ff712faee10 RtlVirtualUnwind 4837->4838 4839 7ff712faec17 4837->4839 4838->4837 4838->4839 4840 7ff712faebb8 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 4839->4840 4843 7ff712fae5d2 GetLastError 4842->4843 4844 7ff712fae3e8 4842->4844 4843->4844 4844->4544 4844->4545 5127 7ff712fa57a0 4845->5127 4848 7ff712fa1a7e ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J ??7ios_base@std@ 4848->4606 4848->4607 4849 7ff712fa5399 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 4849->4848 4851 7ff712fa5755 4850->4851 4852 7ff712fa56f7 4850->4852 4853 7ff712fa5757 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 4851->4853 5157 7ff712fa55f0 4852->5157 4853->4611 4855 7ff712fa5731 fclose 4855->4853 4857 7ff712fa20a6 4856->4857 4858 7ff712fa20e3 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA 4857->4858 4859 7ff712fa56e0 12 API calls 4857->4859 4859->4858 4861 7ff712facf87 4860->4861 4891 7ff712fad387 4861->4891 5169 7ff712fa7e60 4861->5169 4864 7ff712fad38d 5202 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4864->5202 4865 7ff712facfd7 4865->4864 4868 7ff712fa7e60 6 API calls 4865->4868 4869 7ff712fad019 RegCreateKeyW 4868->4869 4870 7ff712fad046 RegSetKeyValueW 4869->4870 4871 7ff712fad03d 4869->4871 4872 7ff712fad083 RegCloseKey 4870->4872 4873 7ff712fad0f8 RegSetKeyValueW 4870->4873 4883 7ff712fad382 4871->4883 4886 7ff712fa7e60 6 API calls 4871->4886 5182 7ff712fa73f0 4871->5182 4872->4871 4874 7ff712fad129 RegCloseKey 4873->4874 4875 7ff712fad13b RegCloseKey GetModuleHandleA 4873->4875 4874->4871 4877 7ff712fad15a GetProcAddress GetProcAddress 4875->4877 4895 7ff712fad0ac 4875->4895 4877->4871 4879 7ff712fad2ac 4880 7ff712fad301 4879->4880 4884 7ff712fad2fa _invalid_parameter_noinfo_noreturn 4879->4884 4882 7ff712fad356 4880->4882 4888 7ff712fad34f _invalid_parameter_noinfo_noreturn 4880->4888 4881 7ff712fad0f1 _invalid_parameter_noinfo_noreturn 4881->4873 4885 7ff712fae7b0 8 API calls 4882->4885 5200 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4883->5200 4884->4880 4889 7ff712fa1b24 4885->4889 4890 7ff712fad1e1 RtlInitUnicodeString 4886->4890 4888->4882 4889->4626 4889->4627 4892 7ff712fad200 4890->4892 5201 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4891->5201 4893 7ff712fa73f0 29 API calls 4892->4893 4894 7ff712fad215 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4893->4894 4894->4895 4895->4879 4895->4881 4896 7ff712fad289 _invalid_parameter_noinfo_noreturn 4895->4896 4896->4895 4898 7ff712fa7ab1 4897->4898 4899 7ff712fa79e6 4897->4899 5217 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 4898->5217 4900 7ff712fa79f4 memmove 4899->4900 4901 7ff712fa7a0c 4899->4901 4900->4633 4903 7ff712fa7a1d 4901->4903 4904 7ff712fa7ab6 4901->4904 4905 7ff712fa7a74 4901->4905 4906 7ff712fae8f8 std::_Facet_Register 3 API calls 4903->4906 4907 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 4904->4907 4908 7ff712fae8f8 std::_Facet_Register 3 API calls 4905->4908 4912 7ff712fa7a38 memmove 4905->4912 4910 7ff712fa7a33 4906->4910 4911 7ff712fa7abc 4907->4911 4908->4912 4910->4912 4913 7ff712fa7a6d _invalid_parameter_noinfo_noreturn 4910->4913 4912->4633 4913->4905 4915 7ff712fad9a0 4914->4915 4916 7ff712fad9ee 4914->4916 4917 7ff712fad9a5 VirtualFree 4915->4917 4918 7ff712fad9b6 VirtualAlloc NtQuerySystemInformation 4915->4918 4919 7ff712fad9f2 4916->4919 4927 7ff712fada0f 4916->4927 4917->4918 4918->4915 4918->4916 4920 7ff712fad9f7 VirtualFree 4919->4920 4929 7ff712fada14 4919->4929 4920->4929 4921 7ff712fadaf2 VirtualFree 4921->4929 4922 7ff712fae7b0 8 API calls 4923 7ff712fa1bdb 4922->4923 4923->4638 4923->4640 4924 7ff712fa79c0 7 API calls 4924->4927 4925 7ff712fada90 _stricmp 4926 7ff712fadb28 VirtualFree 4925->4926 4925->4927 4928 7ff712fadb48 4926->4928 4926->4929 4927->4921 4927->4924 4927->4925 4927->4929 4930 7ff712fadb71 _invalid_parameter_noinfo_noreturn 4927->4930 4928->4929 4928->4930 4929->4922 4930->4929 5218 7ff712fa3b10 4931->5218 4934 7ff712fa3b10 24 API calls 4935 7ff712fa3379 4934->4935 4936 7ff712fa3418 4935->4936 4937 7ff712fa3b10 24 API calls 4935->4937 4938 7ff712fa33c5 4936->4938 4939 7ff712fa3438 4936->4939 4940 7ff712fa33b2 4937->4940 4943 7ff712fa5910 9 API calls 4938->4943 4941 7ff712fa73f0 29 API calls 4939->4941 4940->4938 4944 7ff712fa5910 9 API calls 4940->4944 4942 7ff712fa3444 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4941->4942 4945 7ff712fa73f0 29 API calls 4942->4945 4946 7ff712fa33d1 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4943->4946 4947 7ff712fa33f4 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4944->4947 4948 7ff712fa3487 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4945->4948 4972 7ff712fa3953 4946->4972 4947->4936 5235 7ff712fa2110 4948->5235 4949 7ff712fae7b0 8 API calls 4951 7ff712fa1c3f 4949->4951 4951->4645 5004 7ff712fa3cf0 4951->5004 4952 7ff712fa34d9 4953 7ff712fa2110 9 API calls 4952->4953 4954 7ff712fa350e 4953->4954 5243 7ff712fa2e90 4954->5243 4957 7ff712fa5910 9 API calls 4958 7ff712fa3550 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4957->4958 4959 7ff712fa3569 4958->4959 5261 7ff712fa3120 4959->5261 4962 7ff712fa2110 9 API calls 4963 7ff712fa35ad 4962->4963 4965 7ff712fa2110 9 API calls 4963->4965 4969 7ff712fa358b 4963->4969 4964 7ff712fa5910 9 API calls 4966 7ff712fa38f8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4964->4966 4967 7ff712fa35d2 4965->4967 4968 7ff712fa2fe0 54 API calls 4966->4968 4967->4969 4970 7ff712fa73f0 29 API calls 4967->4970 4974 7ff712fa3913 4968->4974 4969->4964 4971 7ff712fa35f5 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4970->4971 4971->4969 4973 7ff712fa362e DeviceIoControl 4971->4973 4972->4949 4973->4969 4975 7ff712fa368a 4973->4975 4974->4972 4976 7ff712fa394c _invalid_parameter_noinfo_noreturn 4974->4976 4975->4969 4977 7ff712fa3698 DeviceIoControl 4975->4977 4976->4972 4977->4969 4978 7ff712fa36f4 4977->4978 4978->4969 4979 7ff712fa37d1 4978->4979 5281 7ff712fae880 AcquireSRWLockExclusive 4978->5281 4980 7ff712fa380a 4979->4980 4981 7ff712fa37db 4979->4981 5286 7ff712fa6f50 4980->5286 4985 7ff712fa5910 9 API calls 4981->4985 4986 7ff712fa37ee ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 4985->4986 4986->4969 4990 7ff712fa3828 4992 7ff712fa2110 9 API calls 4990->4992 4994 7ff712fa3845 4992->4994 4996 7ff712fa38aa 4994->4996 4997 7ff712fa3856 DeviceIoControl 4994->4997 5312 7ff712fa2fe0 4996->5312 4997->4996 5001 7ff712fa38b5 5002 7ff712fa5910 9 API calls 5001->5002 5003 7ff712fa38c8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5002->5003 5003->4974 5005 7ff712fa79c0 7 API calls 5004->5005 5006 7ff712fa3d4b 5005->5006 5007 7ff712fad960 24 API calls 5006->5007 5008 7ff712fa3d55 5007->5008 5009 7ff712fa3d91 5008->5009 5011 7ff712fa3d8a _invalid_parameter_noinfo_noreturn 5008->5011 5010 7ff712fa3b10 24 API calls 5009->5010 5026 7ff712fa3d9b 5009->5026 5015 7ff712fa3dc5 5010->5015 5011->5009 5012 7ff712fa5910 9 API calls 5014 7ff712fa4647 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5012->5014 5013 7ff712fa3de2 5016 7ff712fa5910 9 API calls 5013->5016 5063 7ff712fa4096 5014->5063 5015->5013 5019 7ff712fa2110 9 API calls 5015->5019 5015->5026 5017 7ff712fa3df5 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5016->5017 5017->5026 5018 7ff712fae7b0 8 API calls 5020 7ff712fa1c54 5018->5020 5021 7ff712fa3e32 5019->5021 5020->4645 5094 7ff712fa2ae0 NtQuerySystemInformation 5020->5094 5021->5013 5022 7ff712fa3e3f 5021->5022 5023 7ff712fa3e83 5022->5023 5027 7ff712fa3ec5 5022->5027 5024 7ff712fa5910 9 API calls 5023->5024 5025 7ff712fa3e96 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5024->5025 5025->5026 5026->5012 5026->5063 5027->5026 5028 7ff712fa2110 9 API calls 5027->5028 5029 7ff712fa3efd 5028->5029 5030 7ff712fa2110 9 API calls 5029->5030 5031 7ff712fa3f30 5030->5031 5031->5026 5032 7ff712fa5910 9 API calls 5031->5032 5033 7ff712fa3f6e ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5032->5033 5034 7ff712fa2e90 54 API calls 5033->5034 5035 7ff712fa3fa5 5034->5035 5035->5026 5036 7ff712fa5910 9 API calls 5035->5036 5037 7ff712fa3fc8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5036->5037 5038 7ff712fa2110 9 API calls 5037->5038 5039 7ff712fa3ff3 5038->5039 5040 7ff712fa3ff7 5039->5040 5041 7ff712fa4039 5039->5041 5042 7ff712fa5910 9 API calls 5040->5042 5043 7ff712fa4041 5041->5043 5072 7ff712fa409d 5041->5072 5044 7ff712fa400a ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5042->5044 5045 7ff712fa5910 9 API calls 5043->5045 5046 7ff712fa2fe0 54 API calls 5044->5046 5047 7ff712fa4054 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5045->5047 5046->5026 5048 7ff712fa2fe0 54 API calls 5047->5048 5049 7ff712fa406f 5048->5049 5051 7ff712fa5910 9 API calls 5049->5051 5049->5063 5050 7ff712fa456f 5053 7ff712fa2fe0 54 API calls 5050->5053 5052 7ff712fa4086 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5051->5052 5052->5063 5055 7ff712fa457f 5053->5055 5054 7ff712fa2110 9 API calls 5054->5072 5056 7ff712fa5910 9 API calls 5055->5056 5059 7ff712fa4512 5055->5059 5057 7ff712fa4596 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5056->5057 5057->5059 5058 7ff712fa45e6 5058->5063 5064 7ff712fa4623 _invalid_parameter_noinfo_noreturn 5058->5064 5059->5058 5061 7ff712fa45df _invalid_parameter_noinfo_noreturn 5059->5061 5060 7ff712fa5910 9 API calls 5062 7ff712fa454f ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5060->5062 5061->5058 5062->5050 5063->5018 5064->5063 5065 7ff712fa416c memset 5066 7ff712fa2110 9 API calls 5065->5066 5066->5072 5067 7ff712fa7880 7 API calls 5067->5072 5068 7ff712fa4355 5070 7ff712fa5910 9 API calls 5068->5070 5069 7ff712fa434e _invalid_parameter_noinfo_noreturn 5069->5068 5071 7ff712fa4368 5070->5071 5073 7ff712fa7880 7 API calls 5071->5073 5072->5050 5072->5054 5072->5065 5072->5067 5072->5068 5072->5069 5086 7ff712fa4424 5072->5086 5074 7ff712fa4396 5073->5074 5075 7ff712fa7fa0 9 API calls 5074->5075 5076 7ff712fa43b1 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5075->5076 5077 7ff712fa4400 5076->5077 5078 7ff712fa43cc 5076->5078 5079 7ff712fa2110 9 API calls 5077->5079 5078->5077 5080 7ff712fa43f9 _invalid_parameter_noinfo_noreturn 5078->5080 5081 7ff712fa4420 5079->5081 5080->5077 5082 7ff712fa443d DeviceIoControl 5081->5082 5081->5086 5083 7ff712fa4499 5082->5083 5082->5086 5470 7ff712fa2660 5083->5470 5085 7ff712fa44a6 5085->5086 5087 7ff712fa44bd 5085->5087 5086->5060 5088 7ff712fa5910 9 API calls 5087->5088 5089 7ff712fa44c9 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5088->5089 5090 7ff712fa2fe0 54 API calls 5089->5090 5091 7ff712fa44e9 5090->5091 5091->5059 5092 7ff712fa5910 9 API calls 5091->5092 5093 7ff712fa4500 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5092->5093 5093->5050 5095 7ff712fa2b29 5094->5095 5104 7ff712fa2b76 5094->5104 5096 7ff712fa2b30 VirtualFree VirtualAlloc NtQuerySystemInformation 5095->5096 5096->5096 5096->5104 5097 7ff712fa2bff 5098 7ff712fa2e41 VirtualFree 5097->5098 5126 7ff712fa2dfc 5097->5126 5098->5126 5099 7ff712fa2c09 VirtualFree 5100 7ff712fa2c23 5099->5100 5099->5126 5103 7ff712fa2110 9 API calls 5100->5103 5101 7ff712fa2bb0 GetCurrentProcessId 5101->5104 5102 7ff712fae7b0 8 API calls 5105 7ff712fa2e70 5102->5105 5106 7ff712fa2c3d 5103->5106 5104->5097 5104->5099 5104->5101 5107 7ff712fa2c04 5104->5107 5104->5126 5105->4645 5108 7ff712fa2d33 5106->5108 5109 7ff712fa2110 9 API calls 5106->5109 5107->5099 5110 7ff712fa5910 9 API calls 5108->5110 5111 7ff712fa2c6c 5109->5111 5112 7ff712fa2d46 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5110->5112 5111->5108 5113 7ff712fa2110 9 API calls 5111->5113 5112->5126 5114 7ff712fa2c9b 5113->5114 5114->5108 5115 7ff712fa2110 9 API calls 5114->5115 5116 7ff712fa2ccd 5115->5116 5116->5108 5117 7ff712fa2d05 memset 5116->5117 5118 7ff712fa2110 9 API calls 5117->5118 5119 7ff712fa2d2f 5118->5119 5119->5108 5120 7ff712fa2d6e DeviceIoControl 5119->5120 5120->5108 5121 7ff712fa2dc6 5120->5121 5122 7ff712fa5910 9 API calls 5121->5122 5123 7ff712fa2dd9 5122->5123 5124 7ff712fa5910 9 API calls 5123->5124 5125 7ff712fa2de4 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5124->5125 5125->5126 5126->5102 5128 7ff712fa57ce ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH 5127->5128 5135 7ff712fa588a 5127->5135 5129 7ff712fa57ec ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ _get_stream_buffer_pointers ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2 5128->5129 5128->5135 5136 7ff712fa7660 ??0_Lockit@std@@QEAA@H ??Bid@locale@std@ 5129->5136 5130 7ff712fae7b0 8 API calls 5132 7ff712fa5394 5130->5132 5132->4848 5132->4849 5134 7ff712fa5890 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5134->5135 5135->5130 5137 7ff712fa76c2 5136->5137 5138 7ff712fa7737 ??1_Lockit@std@@QEAA 5137->5138 5139 7ff712fa76d9 ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12 5137->5139 5140 7ff712fa76e5 5137->5140 5141 7ff712fae7b0 8 API calls 5138->5141 5139->5140 5140->5138 5143 7ff712fa76fc ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@ 5140->5143 5142 7ff712fa587a ?always_noconv@codecvt_base@std@ 5141->5142 5142->5134 5142->5135 5144 7ff712fa7710 5143->5144 5145 7ff712fa7767 5143->5145 5150 7ff712fadf74 5144->5150 5153 7ff712fa1220 5145->5153 5148 7ff712fa776c 5151 7ff712fae8f8 std::_Facet_Register 3 API calls 5150->5151 5152 7ff712fa7722 5151->5152 5152->5138 5156 7ff712fa11f0 5153->5156 5155 7ff712fa122e _CxxThrowException __std_exception_copy 5155->5148 5156->5155 5158 7ff712fa56c3 5157->5158 5159 7ff712fa5613 5157->5159 5160 7ff712fae7b0 8 API calls 5158->5160 5159->5158 5161 7ff712fa561d 5159->5161 5162 7ff712fa56d2 5160->5162 5163 7ff712fa5636 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD 5161->5163 5165 7ff712fa5661 5161->5165 5162->4855 5164 7ff712fa565c 5163->5164 5164->5165 5168 7ff712fa5697 fwrite 5164->5168 5166 7ff712fae7b0 8 API calls 5165->5166 5167 7ff712fa567e 5166->5167 5167->4855 5168->5165 5170 7ff712fa7f4e memmove memmove 5169->5170 5171 7ff712fa7eb7 5169->5171 5170->4865 5172 7ff712fa7f96 5171->5172 5173 7ff712fa7f39 5171->5173 5174 7ff712fa7f17 5171->5174 5175 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5172->5175 5178 7ff712fa7f24 5173->5178 5180 7ff712fae8f8 std::_Facet_Register 3 API calls 5173->5180 5177 7ff712fae8f8 std::_Facet_Register 3 API calls 5174->5177 5176 7ff712fa7f9b 5175->5176 5179 7ff712fa7f1f 5177->5179 5178->5170 5179->5178 5181 7ff712fa7f32 _invalid_parameter_noinfo_noreturn 5179->5181 5180->5178 5181->5173 5186 7ff712fa7420 ?good@ios_base@std@ 5182->5186 5184 7ff712fa74a1 5187 7ff712fa74b5 ?getloc@ios_base@std@@QEBA?AVlocale@2 5184->5187 5188 7ff712fa74ab ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 5184->5188 5185 7ff712fa7473 5185->5184 5190 7ff712fa7489 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 ?good@ios_base@std@ 5185->5190 5186->5184 5186->5185 5203 7ff712fa7770 ??0_Lockit@std@@QEAA@H ??Bid@locale@std@ 5187->5203 5192 7ff712fa7627 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 5188->5192 5194 7ff712fa7631 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5188->5194 5190->5184 5192->5194 5193 7ff712fa74d3 5195 7ff712fa7542 5193->5195 5196 7ff712fa7525 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 5193->5196 5194->4895 5195->5188 5197 7ff712fa75b0 5195->5197 5198 7ff712fa7560 ?widen@?$ctype@_W@std@@QEBA_WD ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 5195->5198 5196->5193 5196->5195 5197->5188 5199 7ff712fa75b5 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W 5197->5199 5198->5195 5199->5188 5199->5197 5204 7ff712fa77d2 5203->5204 5205 7ff712fa7847 ??1_Lockit@std@@QEAA 5204->5205 5206 7ff712fa77e9 ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12 5204->5206 5207 7ff712fa77f5 5204->5207 5208 7ff712fae7b0 8 API calls 5205->5208 5206->5207 5207->5205 5210 7ff712fa780c ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@ 5207->5210 5209 7ff712fa7862 5208->5209 5209->5193 5211 7ff712fa7820 5210->5211 5212 7ff712fa7877 5210->5212 5213 7ff712fadf74 std::_Facet_Register 3 API calls 5211->5213 5214 7ff712fa1220 Concurrency::cancel_current_task 2 API calls 5212->5214 5215 7ff712fa7832 5213->5215 5216 7ff712fa787c 5214->5216 5215->5205 5219 7ff712fa3b20 5218->5219 5220 7ff712fa3b8b 5219->5220 5221 7ff712fa2110 9 API calls 5219->5221 5353 7ff712fa3990 5220->5353 5222 7ff712fa3b64 5221->5222 5225 7ff712fa3b68 5222->5225 5233 7ff712fa3b93 5222->5233 5224 7ff712fa3ccd 5226 7ff712fae7b0 8 API calls 5224->5226 5227 7ff712fa5910 9 API calls 5225->5227 5228 7ff712fa3350 5226->5228 5229 7ff712fa3b7b ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5227->5229 5228->4934 5229->5220 5230 7ff712fa3c00 memcmp 5230->5233 5231 7ff712fa5910 9 API calls 5232 7ff712fa3c78 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5231->5232 5232->5220 5233->5230 5233->5233 5234 7ff712fa3c3e 5233->5234 5234->5220 5234->5231 5236 7ff712fa2198 5235->5236 5237 7ff712fa212e 5235->5237 5238 7ff712fae7b0 8 API calls 5236->5238 5237->5236 5239 7ff712fa2138 DeviceIoControl 5237->5239 5240 7ff712fa21a7 5238->5240 5241 7ff712fae7b0 8 API calls 5239->5241 5240->4952 5242 7ff712fa2190 5241->5242 5242->4952 5244 7ff712fa2ea9 5243->5244 5253 7ff712fa2fa0 5243->5253 5245 7ff712fa2f73 5244->5245 5248 7ff712fae880 3 API calls 5244->5248 5246 7ff712fa2fb0 5245->5246 5247 7ff712fa2f7d 5245->5247 5391 7ff712fa6af0 5246->5391 5250 7ff712fa5910 9 API calls 5247->5250 5251 7ff712fa2ed5 5248->5251 5252 7ff712fa2f90 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5250->5252 5251->5245 5254 7ff712fa79c0 7 API calls 5251->5254 5252->5253 5253->4957 5255 7ff712fa2f0a 5254->5255 5368 7ff712fa27a0 5255->5368 5258 7ff712fa2f61 5390 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5258->5390 5260 7ff712fa2f5a _invalid_parameter_noinfo_noreturn 5260->5258 5264 7ff712fa3180 5261->5264 5262 7ff712fae7b0 8 API calls 5265 7ff712fa32ea 5262->5265 5263 7ff712fa3280 5266 7ff712fa32af 5263->5266 5267 7ff712fa328a 5263->5267 5264->5263 5268 7ff712fae880 3 API calls 5264->5268 5272 7ff712fa32c9 5264->5272 5265->4962 5265->4969 5440 7ff712fa71a0 5266->5440 5270 7ff712fa5910 9 API calls 5267->5270 5271 7ff712fa31d0 5268->5271 5273 7ff712fa329d ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5270->5273 5271->5263 5274 7ff712fa79c0 7 API calls 5271->5274 5272->5262 5273->5272 5275 7ff712fa3205 5274->5275 5276 7ff712fa27a0 24 API calls 5275->5276 5277 7ff712fa321a 5276->5277 5278 7ff712fa325c 5277->5278 5280 7ff712fa3255 _invalid_parameter_noinfo_noreturn 5277->5280 5439 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5278->5439 5280->5278 5282 7ff712fae896 5281->5282 5283 7ff712fae89b ReleaseSRWLockExclusive 5282->5283 5285 7ff712fae8a0 SleepConditionVariableSRW 5282->5285 5285->5282 5287 7ff712fa6f8c 5286->5287 5311 7ff712fa6fc6 5286->5311 5288 7ff712fa6f91 GetModuleHandleA 5287->5288 5287->5311 5290 7ff712fa6fe9 GetProcAddress 5288->5290 5291 7ff712fa6fa3 5288->5291 5289 7ff712fae7b0 8 API calls 5292 7ff712fa381e 5289->5292 5290->5291 5293 7ff712fa700a 5290->5293 5294 7ff712fa5910 9 API calls 5291->5294 5292->4969 5292->4990 5295 7ff712fa70e7 5293->5295 5297 7ff712fae880 3 API calls 5293->5297 5296 7ff712fa6fb6 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5294->5296 5299 7ff712fa2110 9 API calls 5295->5299 5296->5311 5298 7ff712fa7049 5297->5298 5298->5295 5300 7ff712fa79c0 7 API calls 5298->5300 5303 7ff712fa7112 5299->5303 5301 7ff712fa707e 5300->5301 5302 7ff712fa27a0 24 API calls 5301->5302 5305 7ff712fa7093 5302->5305 5304 7ff712fa21b0 27 API calls 5303->5304 5303->5311 5306 7ff712fa7166 5304->5306 5307 7ff712fa70d5 5305->5307 5309 7ff712fa70ce _invalid_parameter_noinfo_noreturn 5305->5309 5310 7ff712fa21b0 27 API calls 5306->5310 5306->5311 5467 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5307->5467 5309->5307 5310->5311 5311->5289 5313 7ff712fa30f0 5312->5313 5314 7ff712fa2ff9 5312->5314 5313->5001 5315 7ff712fa30c3 5314->5315 5318 7ff712fae880 3 API calls 5314->5318 5316 7ff712fa30fd 5315->5316 5317 7ff712fa30cd 5315->5317 5322 7ff712fa6d4d GetModuleHandleA 5316->5322 5352 7ff712fa6d82 5316->5352 5319 7ff712fa5910 9 API calls 5317->5319 5320 7ff712fa3025 5318->5320 5321 7ff712fa30e0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5319->5321 5320->5315 5323 7ff712fa79c0 7 API calls 5320->5323 5321->5313 5324 7ff712fa6d5f 5322->5324 5325 7ff712fa6da1 GetProcAddress 5322->5325 5328 7ff712fa305a 5323->5328 5332 7ff712fa5910 9 API calls 5324->5332 5325->5324 5327 7ff712fa6dc2 5325->5327 5326 7ff712fae7b0 8 API calls 5329 7ff712fa6d91 5326->5329 5330 7ff712fa6e9f 5327->5330 5333 7ff712fae880 3 API calls 5327->5333 5331 7ff712fa27a0 24 API calls 5328->5331 5329->5001 5337 7ff712fa2110 9 API calls 5330->5337 5334 7ff712fa306f 5331->5334 5335 7ff712fa6d72 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5332->5335 5336 7ff712fa6e01 5333->5336 5338 7ff712fa30b1 5334->5338 5341 7ff712fa30aa _invalid_parameter_noinfo_noreturn 5334->5341 5335->5352 5336->5330 5340 7ff712fa79c0 7 API calls 5336->5340 5345 7ff712fa6eca 5337->5345 5468 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5338->5468 5342 7ff712fa6e36 5340->5342 5341->5338 5344 7ff712fa27a0 24 API calls 5342->5344 5343 7ff712fa21b0 27 API calls 5350 7ff712fa6f1e 5343->5350 5346 7ff712fa6e4b 5344->5346 5345->5343 5345->5352 5347 7ff712fa6e8d 5346->5347 5349 7ff712fa6e86 _invalid_parameter_noinfo_noreturn 5346->5349 5469 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5347->5469 5349->5347 5351 7ff712fa21b0 27 API calls 5350->5351 5350->5352 5351->5352 5352->5326 5354 7ff712fa39e0 5353->5354 5355 7ff712fa39b6 5353->5355 5354->5355 5356 7ff712fa39f2 5354->5356 5357 7ff712fa5910 9 API calls 5355->5357 5359 7ff712fa2110 9 API calls 5356->5359 5358 7ff712fa39c9 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5357->5358 5367 7ff712fa3ad6 5358->5367 5360 7ff712fa3a13 5359->5360 5361 7ff712fa3a17 5360->5361 5366 7ff712fa3a3f 5360->5366 5362 7ff712fa5910 9 API calls 5361->5362 5363 7ff712fa3a2a ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5362->5363 5363->5367 5364 7ff712fa5910 9 API calls 5365 7ff712fa3abe ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5364->5365 5365->5367 5366->5364 5366->5367 5367->5224 5369 7ff712fa27d1 memset 5368->5369 5388 7ff712fa29f3 5368->5388 5370 7ff712fa2110 9 API calls 5369->5370 5372 7ff712fa2819 5370->5372 5371 7ff712fae7b0 8 API calls 5373 7ff712fa2a23 5371->5373 5374 7ff712fa2110 9 API calls 5372->5374 5372->5388 5373->5258 5373->5260 5375 7ff712fa2852 5374->5375 5376 7ff712fa2889 VirtualAlloc 5375->5376 5375->5388 5377 7ff712fa2110 9 API calls 5376->5377 5378 7ff712fa28d9 5377->5378 5379 7ff712fa28dd VirtualFree 5378->5379 5385 7ff712fa28f5 5378->5385 5379->5388 5380 7ff712fa29e0 VirtualFree 5380->5388 5381 7ff712fa79c0 7 API calls 5381->5385 5382 7ff712fa2974 _stricmp 5383 7ff712fa2a30 5382->5383 5382->5385 5384 7ff712fa2ab1 VirtualFree 5383->5384 5386 7ff712fa2a63 VirtualFree 5383->5386 5389 7ff712fa2a74 5383->5389 5384->5389 5385->5380 5385->5381 5385->5382 5387 7ff712fa2aaa _invalid_parameter_noinfo_noreturn 5385->5387 5386->5389 5387->5384 5388->5371 5389->5387 5389->5388 5392 7ff712fa6b1f 5391->5392 5393 7ff712fa6b59 5391->5393 5392->5393 5394 7ff712fa6b24 GetModuleHandleA 5392->5394 5397 7ff712fae7b0 8 API calls 5393->5397 5395 7ff712fa6b73 GetProcAddress 5394->5395 5396 7ff712fa6b36 5394->5396 5395->5396 5399 7ff712fa6b94 5395->5399 5400 7ff712fa5910 9 API calls 5396->5400 5398 7ff712fa6b68 5397->5398 5398->5253 5401 7ff712fa6c71 5399->5401 5402 7ff712fae880 3 API calls 5399->5402 5403 7ff712fa6b49 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5400->5403 5405 7ff712fa2110 9 API calls 5401->5405 5404 7ff712fa6bd3 5402->5404 5403->5393 5404->5401 5406 7ff712fa79c0 7 API calls 5404->5406 5409 7ff712fa6c9c 5405->5409 5407 7ff712fa6c08 5406->5407 5408 7ff712fa27a0 24 API calls 5407->5408 5411 7ff712fa6c1d 5408->5411 5409->5393 5418 7ff712fa21b0 5409->5418 5413 7ff712fa6c5f 5411->5413 5415 7ff712fa6c58 _invalid_parameter_noinfo_noreturn 5411->5415 5417 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5413->5417 5415->5413 5416 7ff712fa21b0 27 API calls 5416->5393 5419 7ff712fa21e2 5418->5419 5435 7ff712fa2390 5418->5435 5420 7ff712fa21eb DeviceIoControl 5419->5420 5419->5435 5421 7ff712fa2273 5420->5421 5422 7ff712fa223d 5420->5422 5426 7ff712fa2288 DeviceIoControl 5421->5426 5427 7ff712fa23bd 5421->5427 5424 7ff712fa5910 9 API calls 5422->5424 5423 7ff712fae7b0 8 API calls 5425 7ff712fa23b0 5423->5425 5428 7ff712fa2250 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5424->5428 5425->5393 5425->5416 5426->5427 5430 7ff712fa22e4 5426->5430 5429 7ff712fa5910 9 API calls 5427->5429 5428->5435 5431 7ff712fa23d0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5429->5431 5430->5427 5432 7ff712fa22f1 5430->5432 5431->5435 5433 7ff712fa2110 9 API calls 5432->5433 5434 7ff712fa2305 DeviceIoControl 5433->5434 5434->5435 5436 7ff712fa2361 5434->5436 5435->5423 5437 7ff712fa5910 9 API calls 5436->5437 5438 7ff712fa2374 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5437->5438 5438->5435 5441 7ff712fa71dc 5440->5441 5465 7ff712fa7216 5440->5465 5442 7ff712fa71e1 GetModuleHandleA 5441->5442 5441->5465 5443 7ff712fa71f3 5442->5443 5444 7ff712fa7239 GetProcAddress 5442->5444 5448 7ff712fa5910 9 API calls 5443->5448 5444->5443 5447 7ff712fa725a 5444->5447 5445 7ff712fae7b0 8 API calls 5446 7ff712fa7225 5445->5446 5446->5272 5450 7ff712fa7337 5447->5450 5451 7ff712fae880 3 API calls 5447->5451 5449 7ff712fa7206 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5448->5449 5449->5465 5453 7ff712fa2110 9 API calls 5450->5453 5452 7ff712fa7299 5451->5452 5452->5450 5454 7ff712fa79c0 7 API calls 5452->5454 5457 7ff712fa7362 5453->5457 5455 7ff712fa72ce 5454->5455 5456 7ff712fa27a0 24 API calls 5455->5456 5459 7ff712fa72e3 5456->5459 5458 7ff712fa21b0 27 API calls 5457->5458 5457->5465 5460 7ff712fa73b6 5458->5460 5461 7ff712fa7325 5459->5461 5463 7ff712fa731e _invalid_parameter_noinfo_noreturn 5459->5463 5464 7ff712fa21b0 27 API calls 5460->5464 5460->5465 5466 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5461->5466 5463->5461 5464->5465 5465->5445 5471 7ff712fa2770 5470->5471 5472 7ff712fa2679 5470->5472 5471->5085 5473 7ff712fa2743 5472->5473 5476 7ff712fae880 3 API calls 5472->5476 5474 7ff712fa277d 5473->5474 5475 7ff712fa274d 5473->5475 5480 7ff712fa6922 5474->5480 5481 7ff712fa68ed GetModuleHandleA 5474->5481 5477 7ff712fa5910 9 API calls 5475->5477 5478 7ff712fa26a5 5476->5478 5479 7ff712fa2760 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5477->5479 5478->5473 5482 7ff712fa79c0 7 API calls 5478->5482 5479->5471 5485 7ff712fae7b0 8 API calls 5480->5485 5483 7ff712fa68ff 5481->5483 5484 7ff712fa6941 GetProcAddress 5481->5484 5487 7ff712fa26da 5482->5487 5491 7ff712fa5910 9 API calls 5483->5491 5484->5483 5486 7ff712fa6962 5484->5486 5488 7ff712fa6931 5485->5488 5489 7ff712fa6a3f 5486->5489 5493 7ff712fae880 3 API calls 5486->5493 5490 7ff712fa27a0 24 API calls 5487->5490 5488->5085 5496 7ff712fa2110 9 API calls 5489->5496 5494 7ff712fa26ef 5490->5494 5492 7ff712fa6912 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5491->5492 5492->5480 5495 7ff712fa69a1 5493->5495 5497 7ff712fa2731 5494->5497 5500 7ff712fa272a _invalid_parameter_noinfo_noreturn 5494->5500 5495->5489 5499 7ff712fa79c0 7 API calls 5495->5499 5502 7ff712fa6a6a 5496->5502 5511 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5497->5511 5501 7ff712fa69d6 5499->5501 5500->5497 5504 7ff712fa27a0 24 API calls 5501->5504 5502->5480 5503 7ff712fa21b0 27 API calls 5502->5503 5505 7ff712fa6abe 5503->5505 5506 7ff712fa69eb 5504->5506 5505->5480 5510 7ff712fa21b0 27 API calls 5505->5510 5507 7ff712fa6a2d 5506->5507 5509 7ff712fa6a26 _invalid_parameter_noinfo_noreturn 5506->5509 5512 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5507->5512 5509->5507 5510->5480 5516 7ff712faf2f4 5513->5516 5515 7ff712faf322 _CxxThrowException 5516->5515 5519 7ff712fadc02 5517->5519 5518 7ff712fadc10 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5518->5519 5519->5518 5520 7ff712fadc3b ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5519->5520 5521 7ff712fadccb ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5519->5521 5524 7ff712fadcef ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5519->5524 5525 7ff712fadc5f 5519->5525 5520->5519 5521->5519 5522 7ff712fadca2 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5522->5525 5523 7ff712fadd35 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5523->5525 5524->5519 5525->5522 5525->5523 5526 7ff712fad833 5525->5526 5527 7ff712fadd80 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5525->5527 5529 7ff712faddc0 ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 5525->5529 5534 7ff712faddf0 5525->5534 5526->4667 5527->5525 5529->5525 5531 7ff712fad8f6 5530->5531 5532 7ff712fad933 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA 5531->5532 5533 7ff712fa56e0 12 API calls 5531->5533 5533->5532 5535 7ff712fadf53 5534->5535 5536 7ff712fade28 5534->5536 5550 7ff712faa6c0 ?_Xlength_error@std@@YAXPEBD 5535->5550 5539 7ff712fade9a 5536->5539 5540 7ff712fade4e 5536->5540 5538 7ff712fadf58 5543 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5538->5543 5542 7ff712fae8f8 std::_Facet_Register 3 API calls 5539->5542 5547 7ff712fade5d 5539->5547 5540->5538 5541 7ff712fae8f8 std::_Facet_Register 3 API calls 5540->5541 5541->5547 5542->5547 5544 7ff712fadf5e 5543->5544 5545 7ff712fadf4c _invalid_parameter_noinfo_noreturn 5545->5535 5546 7ff712fadee6 memmove 5548 7ff712fadef3 5546->5548 5549 7ff712fadf18 5546->5549 5547->5545 5547->5546 5548->5545 5548->5549 5549->5525 5552 7ff712faa7da 5551->5552 5553 7ff712faa738 5551->5553 5554 7ff712faa854 5552->5554 5555 7ff712faa7e4 5552->5555 5556 7ff712fae880 3 API calls 5553->5556 5775 7ff712fa5b30 5554->5775 5558 7ff712fa5910 9 API calls 5555->5558 5559 7ff712faa744 5556->5559 5561 7ff712faa7f7 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5558->5561 5559->5552 5563 7ff712fa79c0 7 API calls 5559->5563 5562 7ff712faa807 5561->5562 5566 7ff712fa5910 9 API calls 5562->5566 5564 7ff712faa774 5563->5564 5567 7ff712fa27a0 24 API calls 5564->5567 5565 7ff712fa2110 9 API calls 5568 7ff712faa8b7 5565->5568 5569 7ff712faa81a ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5566->5569 5570 7ff712faa788 5567->5570 5568->5562 5571 7ff712faa8c7 5568->5571 5617 7ff712faa82a 5569->5617 5572 7ff712faa7c8 5570->5572 5579 7ff712faa7c1 _invalid_parameter_noinfo_noreturn 5570->5579 5574 7ff712faa8cf 5571->5574 5575 7ff712faa90d 5571->5575 5774 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5572->5774 5577 7ff712fa5910 9 API calls 5574->5577 5576 7ff712faa9c0 5575->5576 5582 7ff712fae880 3 API calls 5575->5582 5581 7ff712faa9ed 5576->5581 5584 7ff712fa5910 9 API calls 5576->5584 5583 7ff712faa8e2 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5577->5583 5578 7ff712fae7b0 8 API calls 5580 7ff712faa838 5578->5580 5579->5572 5580->4697 5593 7ff712faaa19 5581->5593 5802 7ff712fa5d80 5581->5802 5585 7ff712faa928 5582->5585 5587 7ff712fa2530 54 API calls 5583->5587 5588 7ff712faa9dd ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5584->5588 5585->5576 5590 7ff712fa79c0 7 API calls 5585->5590 5589 7ff712faa8fd 5587->5589 5588->5581 5591 7ff712fa2660 54 API calls 5589->5591 5592 7ff712faa95a 5590->5592 5591->5617 5594 7ff712fa27a0 24 API calls 5592->5594 5595 7ff712faaacc 5593->5595 5597 7ff712fae880 3 API calls 5593->5597 5596 7ff712faa96e 5594->5596 5601 7ff712fa5910 9 API calls 5595->5601 5605 7ff712faaaf9 5595->5605 5599 7ff712faa9ae 5596->5599 5606 7ff712faa9a7 _invalid_parameter_noinfo_noreturn 5596->5606 5600 7ff712faaa34 5597->5600 5801 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5599->5801 5600->5595 5604 7ff712fa79c0 7 API calls 5600->5604 5602 7ff712faaae9 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5601->5602 5602->5605 5607 7ff712faaa66 5604->5607 5608 7ff712fa5910 9 API calls 5605->5608 5609 7ff712faab48 5605->5609 5829 7ff712fa5fd0 5605->5829 5606->5599 5610 7ff712fa27a0 24 API calls 5607->5610 5611 7ff712faab0c ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5608->5611 5612 7ff712fa5910 9 API calls 5609->5612 5613 7ff712faaa7a 5610->5613 5614 7ff712fa2400 54 API calls 5611->5614 5615 7ff712faab5b ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5612->5615 5616 7ff712faaaba 5613->5616 5619 7ff712faaab3 _invalid_parameter_noinfo_noreturn 5613->5619 5614->5605 5615->5617 5828 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5616->5828 5617->5578 5619->5616 5622 7ff712fa66ae 5621->5622 5646 7ff712fa66e8 5621->5646 5623 7ff712fa66b3 GetModuleHandleA 5622->5623 5622->5646 5624 7ff712fa66c5 5623->5624 5625 7ff712fa6708 GetProcAddress 5623->5625 5630 7ff712fa5910 9 API calls 5624->5630 5625->5624 5628 7ff712fa6729 5625->5628 5626 7ff712fae7b0 8 API calls 5627 7ff712fa66f7 5626->5627 5627->4697 5629 7ff712fa6806 5628->5629 5631 7ff712fae880 3 API calls 5628->5631 5634 7ff712fa2110 9 API calls 5629->5634 5632 7ff712fa66d8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5630->5632 5633 7ff712fa6768 5631->5633 5632->5646 5633->5629 5636 7ff712fa79c0 7 API calls 5633->5636 5635 7ff712fa6831 5634->5635 5638 7ff712fa21b0 27 API calls 5635->5638 5635->5646 5637 7ff712fa679d 5636->5637 5639 7ff712fa27a0 24 API calls 5637->5639 5643 7ff712fa6885 5638->5643 5642 7ff712fa67b2 5639->5642 5640 7ff712fa67f4 5858 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5640->5858 5642->5640 5644 7ff712fa67ed _invalid_parameter_noinfo_noreturn 5642->5644 5645 7ff712fa21b0 27 API calls 5643->5645 5643->5646 5644->5640 5645->5646 5646->5626 5648 7ff712fabe4f 5647->5648 5651 7ff712fabe79 5647->5651 5648->5651 5859 7ff712fac7f0 5648->5859 5649 7ff712fae7b0 8 API calls 5650 7ff712faae8b 5649->5650 5653 7ff712fab090 5650->5653 5651->5649 5654 7ff712fab0a5 5653->5654 5655 7ff712fab186 _invalid_parameter_noinfo_noreturn 5654->5655 5656 7ff712fab15e 5654->5656 5656->4718 5658 7ff712fabfa5 5657->5658 5659 7ff712fac20f 5657->5659 5658->5659 5662 7ff712fa79c0 7 API calls 5658->5662 5663 7ff712fac229 _invalid_parameter_noinfo_noreturn 5658->5663 5664 7ff712fa9df0 6 API calls 5658->5664 5665 7ff712fac230 _invalid_parameter_noinfo_noreturn 5658->5665 5667 7ff712fac237 _invalid_parameter_noinfo_noreturn 5658->5667 5668 7ff712fac0da memmove 5658->5668 5878 7ff712fac280 5658->5878 5894 7ff712faca10 5658->5894 5916 7ff712facdd0 5658->5916 5940 7ff712fac3c0 5658->5940 5964 7ff712fabca0 5658->5964 5660 7ff712fae7b0 8 API calls 5659->5660 5661 7ff712faaea2 5660->5661 5673 7ff712fab190 5661->5673 5662->5658 5663->5665 5664->5658 5665->5667 5667->5659 5668->5658 5689 7ff712fab1c7 5673->5689 5674 7ff712fab35d 5676 7ff712fab990 20 API calls 5674->5676 5704 7ff712fab341 5674->5704 5675 7ff712fad960 24 API calls 5675->5689 5702 7ff712fab2f6 5676->5702 5677 7ff712fab299 5680 7ff712fab780 9 API calls 5677->5680 5678 7ff712fae7b0 8 API calls 5679 7ff712fab3dc 5678->5679 5679->4722 5683 7ff712fab2ac 5680->5683 5681 7ff712fab3f3 _invalid_parameter_noinfo_noreturn 5684 7ff712fab411 5681->5684 5690 7ff712fab461 5681->5690 5682 7ff712fa27a0 24 API calls 5682->5689 5685 7ff712faba70 9 API calls 5683->5685 5686 7ff712fab990 20 API calls 5684->5686 5688 7ff712fab290 5685->5688 5687 7ff712fab41a 5686->5687 5687->5690 5691 7ff712fab47c _invalid_parameter_noinfo_noreturn 5687->5691 5692 7ff712fab780 9 API calls 5688->5692 5689->5674 5689->5675 5689->5677 5689->5682 5695 7ff712fab23c 5689->5695 5690->4722 5694 7ff712fab4a1 5691->5694 5698 7ff712fab4e9 5691->5698 5693 7ff712fab2d4 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5692->5693 5697 7ff712fab2ed 5693->5697 5693->5704 5694->5698 5701 7ff712fab504 _invalid_parameter_noinfo_noreturn 5694->5701 6008 7ff712fab780 5695->6008 5700 7ff712fab990 20 API calls 5697->5700 5698->4722 5700->5702 5702->5681 5702->5704 5704->5678 5706 7ff712fab780 9 API calls 5707 7ff712fab277 5706->5707 5708 7ff712faba70 9 API calls 5707->5708 5708->5688 5710 7ff712fa73f0 29 API calls 5709->5710 5711 7ff712fa9307 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z system 5710->5711 5711->4728 5713 7ff712fab57b 5712->5713 5737 7ff712fab5b5 5712->5737 5714 7ff712fab580 GetModuleHandleA 5713->5714 5713->5737 5715 7ff712fab592 5714->5715 5716 7ff712fab5cf GetProcAddress 5714->5716 5721 7ff712fa5910 9 API calls 5715->5721 5716->5715 5719 7ff712fab5f0 5716->5719 5717 7ff712fae7b0 8 API calls 5718 7ff712faaf66 5717->5718 5718->4686 5718->4731 5720 7ff712fab6cd 5719->5720 5722 7ff712fae880 3 API calls 5719->5722 5725 7ff712fa2110 9 API calls 5720->5725 5723 7ff712fab5a5 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5721->5723 5724 7ff712fab62f 5722->5724 5723->5737 5724->5720 5726 7ff712fa79c0 7 API calls 5724->5726 5730 7ff712fab6f8 5725->5730 5727 7ff712fab664 5726->5727 5729 7ff712fa27a0 24 API calls 5727->5729 5728 7ff712fa21b0 27 API calls 5731 7ff712fab74c 5728->5731 5732 7ff712fab679 5729->5732 5730->5728 5730->5737 5736 7ff712fa21b0 27 API calls 5731->5736 5731->5737 5733 7ff712fab6bb 5732->5733 5735 7ff712fab6b4 _invalid_parameter_noinfo_noreturn 5732->5735 6036 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5733->6036 5735->5733 5736->5737 5737->5717 5739 7ff712fa2431 5738->5739 5740 7ff712fa24db 5738->5740 5741 7ff712fae880 3 API calls 5739->5741 5742 7ff712fa2512 5740->5742 5743 7ff712fa24e5 5740->5743 5744 7ff712fa243d 5741->5744 6038 7ff712fa6200 5742->6038 5745 7ff712fa5910 9 API calls 5743->5745 5744->5740 5749 7ff712fa79c0 7 API calls 5744->5749 5748 7ff712fa24f8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5745->5748 5748->4739 5750 7ff712fa2472 5749->5750 5751 7ff712fa27a0 24 API calls 5750->5751 5752 7ff712fa2487 5751->5752 5754 7ff712fa24c2 _invalid_parameter_noinfo_noreturn 5752->5754 5755 7ff712fa24c9 5752->5755 5754->5755 6037 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5755->6037 5757 7ff712fa2560 5756->5757 5758 7ff712fa260a 5756->5758 5759 7ff712fae880 3 API calls 5757->5759 5760 7ff712fa2644 5758->5760 5761 7ff712fa2614 5758->5761 5764 7ff712fa256c 5759->5764 6066 7ff712fa6450 5760->6066 5762 7ff712fa5910 9 API calls 5761->5762 5765 7ff712fa2627 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5762->5765 5764->5758 5767 7ff712fa79c0 7 API calls 5764->5767 5765->4736 5768 7ff712fa25a1 5767->5768 5769 7ff712fa27a0 24 API calls 5768->5769 5770 7ff712fa25b6 5769->5770 5771 7ff712fa25f8 5770->5771 5773 7ff712fa25f1 _invalid_parameter_noinfo_noreturn 5770->5773 6065 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5771->6065 5773->5771 5776 7ff712fa5b5f 5775->5776 5800 7ff712fa5b99 5775->5800 5777 7ff712fa5b64 GetModuleHandleA 5776->5777 5776->5800 5779 7ff712fa5bb3 GetProcAddress 5777->5779 5780 7ff712fa5b76 5777->5780 5778 7ff712fae7b0 8 API calls 5781 7ff712fa5ba8 5778->5781 5779->5780 5782 7ff712fa5bd4 5779->5782 5783 7ff712fa5910 9 API calls 5780->5783 5781->5562 5781->5565 5784 7ff712fa5cb1 5782->5784 5785 7ff712fae880 3 API calls 5782->5785 5786 7ff712fa5b89 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5783->5786 5788 7ff712fa2110 9 API calls 5784->5788 5787 7ff712fa5c13 5785->5787 5786->5800 5787->5784 5789 7ff712fa79c0 7 API calls 5787->5789 5793 7ff712fa5cdc 5788->5793 5790 7ff712fa5c48 5789->5790 5792 7ff712fa27a0 24 API calls 5790->5792 5791 7ff712fa21b0 27 API calls 5794 7ff712fa5d30 5791->5794 5795 7ff712fa5c5d 5792->5795 5793->5791 5793->5800 5799 7ff712fa21b0 27 API calls 5794->5799 5794->5800 5796 7ff712fa5c9f 5795->5796 5798 7ff712fa5c98 _invalid_parameter_noinfo_noreturn 5795->5798 5855 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5796->5855 5798->5796 5799->5800 5800->5778 5803 7ff712fa5db2 5802->5803 5827 7ff712fa5dec 5802->5827 5804 7ff712fa5db7 GetModuleHandleA 5803->5804 5803->5827 5805 7ff712fa5e09 GetProcAddress 5804->5805 5808 7ff712fa5dc9 5804->5808 5805->5808 5809 7ff712fa5e2a 5805->5809 5806 7ff712fae7b0 8 API calls 5807 7ff712fa5dfb 5806->5807 5807->5581 5810 7ff712fa5910 9 API calls 5808->5810 5811 7ff712fa5f07 5809->5811 5813 7ff712fae880 3 API calls 5809->5813 5812 7ff712fa5ddc ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5810->5812 5814 7ff712fa2110 9 API calls 5811->5814 5812->5827 5815 7ff712fa5e69 5813->5815 5819 7ff712fa5f32 5814->5819 5815->5811 5816 7ff712fa79c0 7 API calls 5815->5816 5817 7ff712fa5e9e 5816->5817 5818 7ff712fa27a0 24 API calls 5817->5818 5821 7ff712fa5eb3 5818->5821 5820 7ff712fa21b0 27 API calls 5819->5820 5819->5827 5822 7ff712fa5f86 5820->5822 5823 7ff712fa5ef5 5821->5823 5825 7ff712fa5eee _invalid_parameter_noinfo_noreturn 5821->5825 5826 7ff712fa21b0 27 API calls 5822->5826 5822->5827 5856 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5823->5856 5825->5823 5826->5827 5827->5806 5830 7ff712fa5fff 5829->5830 5854 7ff712fa6039 5829->5854 5831 7ff712fa6004 GetModuleHandleA 5830->5831 5830->5854 5833 7ff712fa6053 GetProcAddress 5831->5833 5834 7ff712fa6016 5831->5834 5832 7ff712fae7b0 8 API calls 5835 7ff712fa6048 5832->5835 5833->5834 5836 7ff712fa6074 5833->5836 5837 7ff712fa5910 9 API calls 5834->5837 5835->5605 5838 7ff712fa6151 5836->5838 5840 7ff712fae880 3 API calls 5836->5840 5839 7ff712fa6029 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 5837->5839 5842 7ff712fa2110 9 API calls 5838->5842 5839->5854 5841 7ff712fa60b3 5840->5841 5841->5838 5844 7ff712fa79c0 7 API calls 5841->5844 5843 7ff712fa617c 5842->5843 5847 7ff712fa21b0 27 API calls 5843->5847 5843->5854 5845 7ff712fa60e8 5844->5845 5846 7ff712fa27a0 24 API calls 5845->5846 5849 7ff712fa60fd 5846->5849 5848 7ff712fa61d0 5847->5848 5853 7ff712fa21b0 27 API calls 5848->5853 5848->5854 5850 7ff712fa613f 5849->5850 5852 7ff712fa6138 _invalid_parameter_noinfo_noreturn 5849->5852 5857 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 5850->5857 5852->5850 5853->5854 5854->5832 5860 7ff712fac9f5 5859->5860 5862 7ff712fac85a 5859->5862 5877 7ff712faa6c0 ?_Xlength_error@std@@YAXPEBD 5860->5877 5863 7ff712fac9fa 5862->5863 5866 7ff712fac8f7 5862->5866 5867 7ff712fac8ce 5862->5867 5864 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5863->5864 5865 7ff712faca00 5864->5865 5868 7ff712fae8f8 std::_Facet_Register 3 API calls 5866->5868 5870 7ff712fac8e0 5866->5870 5867->5863 5869 7ff712fae8f8 std::_Facet_Register 3 API calls 5867->5869 5868->5870 5869->5870 5871 7ff712fac936 5870->5871 5872 7ff712fac93b memmove 5870->5872 5873 7ff712fac9ee _invalid_parameter_noinfo_noreturn 5870->5873 5874 7ff712fac954 memmove 5871->5874 5872->5874 5873->5860 5875 7ff712fac961 5874->5875 5876 7ff712fac9a9 5874->5876 5875->5873 5875->5876 5876->5648 5879 7ff712fac3a6 5878->5879 5880 7ff712fac2a7 5878->5880 5970 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 5879->5970 5881 7ff712fac2e9 5880->5881 5884 7ff712fac322 5880->5884 5883 7ff712fac3ab 5881->5883 5885 7ff712fae8f8 std::_Facet_Register 3 API calls 5881->5885 5887 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5883->5887 5886 7ff712fac30b 5884->5886 5889 7ff712fae8f8 std::_Facet_Register 3 API calls 5884->5889 5885->5886 5888 7ff712fac39f _invalid_parameter_noinfo_noreturn 5886->5888 5891 7ff712fac336 memmove 5886->5891 5890 7ff712fac3b1 5887->5890 5888->5879 5889->5886 5892 7ff712fac357 5891->5892 5893 7ff712fac37c 5891->5893 5892->5888 5892->5893 5893->5658 5895 7ff712faca83 5894->5895 5896 7ff712facdb8 5894->5896 5898 7ff712facdb3 5895->5898 5901 7ff712facb23 5895->5901 5902 7ff712facaed 5895->5902 5997 7ff712faa6c0 ?_Xlength_error@std@@YAXPEBD 5896->5997 5900 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5898->5900 5900->5896 5904 7ff712fae8f8 std::_Facet_Register 3 API calls 5901->5904 5905 7ff712facb00 5901->5905 5902->5898 5903 7ff712fae8f8 std::_Facet_Register 3 API calls 5902->5903 5903->5905 5904->5905 5907 7ff712facdac _invalid_parameter_noinfo_noreturn 5905->5907 5971 7ff712fa9df0 5905->5971 5907->5898 5908 7ff712facb84 5908->5908 5911 7ff712facba7 5908->5911 5988 7ff712fabd80 5908->5988 5910 7ff712fabd80 16 API calls 5912 7ff712facd13 5910->5912 5911->5910 5913 7ff712fabd80 16 API calls 5912->5913 5915 7ff712facd70 5912->5915 5914 7ff712facd25 5913->5914 5914->5907 5914->5915 5915->5658 5917 7ff712facf00 5916->5917 5918 7ff712face2c 5916->5918 5919 7ff712fae7b0 8 API calls 5917->5919 5920 7ff712facf2e 5918->5920 5923 7ff712face80 5918->5923 5926 7ff712face61 5918->5926 5927 7ff712facf29 5918->5927 5921 7ff712facf14 5919->5921 5999 7ff712faa6c0 ?_Xlength_error@std@@YAXPEBD 5920->5999 5921->5658 5924 7ff712face6b 5923->5924 5930 7ff712fae8f8 std::_Facet_Register 3 API calls 5923->5930 5931 7ff712facef5 5924->5931 5937 7ff712fa9df0 6 API calls 5924->5937 5928 7ff712fae8f8 std::_Facet_Register 3 API calls 5926->5928 5929 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5927->5929 5933 7ff712face66 5928->5933 5929->5920 5930->5924 5934 7ff712fabd80 16 API calls 5931->5934 5933->5924 5935 7ff712face79 _invalid_parameter_noinfo_noreturn 5933->5935 5934->5917 5935->5923 5937->5924 5941 7ff712fac433 5940->5941 5942 7ff712fac7db 5940->5942 5944 7ff712fac7d6 5941->5944 5947 7ff712fac4d0 5941->5947 5948 7ff712fac49a 5941->5948 6007 7ff712faa6c0 ?_Xlength_error@std@@YAXPEBD 5942->6007 5946 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5944->5946 5946->5942 5950 7ff712fae8f8 std::_Facet_Register 3 API calls 5947->5950 5951 7ff712fac4ad 5947->5951 5948->5944 5949 7ff712fae8f8 std::_Facet_Register 3 API calls 5948->5949 5949->5951 5950->5951 5952 7ff712fa9df0 6 API calls 5951->5952 5953 7ff712fac7cf _invalid_parameter_noinfo_noreturn 5951->5953 5954 7ff712fac527 5952->5954 5953->5944 5955 7ff712facdd0 21 API calls 5954->5955 5956 7ff712fac53a 5955->5956 5956->5956 5959 7ff712fac550 5956->5959 6000 7ff712fab990 5956->6000 5958 7ff712fab990 20 API calls 5960 7ff712fac740 5958->5960 5959->5958 5961 7ff712fab990 20 API calls 5960->5961 5963 7ff712fac799 5960->5963 5962 7ff712fac752 5961->5962 5962->5953 5962->5963 5963->5658 5965 7ff712fabcb1 5964->5965 5968 7ff712fabd05 5964->5968 5966 7ff712fabd80 16 API calls 5965->5966 5967 7ff712fabcba 5966->5967 5967->5968 5969 7ff712fabd20 _invalid_parameter_noinfo_noreturn 5967->5969 5968->5658 5972 7ff712fa9e1e 5971->5972 5973 7ff712fa9ef9 5972->5973 5978 7ff712fa9e34 5972->5978 5998 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 5973->5998 5974 7ff712fa9e42 5974->5908 5976 7ff712fa9efe 5980 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 5976->5980 5977 7ff712fa9e6a 5981 7ff712fae8f8 std::_Facet_Register 3 API calls 5977->5981 5978->5974 5978->5976 5978->5977 5979 7ff712fa9ec4 5978->5979 5982 7ff712fa9ece memmove 5979->5982 5985 7ff712fae8f8 std::_Facet_Register 3 API calls 5979->5985 5983 7ff712fa9f04 5980->5983 5984 7ff712fa9e80 5981->5984 5982->5908 5986 7ff712fa9e88 5984->5986 5987 7ff712fa9ebd _invalid_parameter_noinfo_noreturn 5984->5987 5985->5982 5986->5982 5987->5979 5989 7ff712fabdee 5988->5989 5990 7ff712fabd85 5988->5990 5989->5911 5990->5989 5991 7ff712fabdfe _invalid_parameter_noinfo_noreturn 5990->5991 5993 7ff712fabe10 5991->5993 5992 7ff712fabe79 5994 7ff712fae7b0 8 API calls 5992->5994 5993->5992 5996 7ff712fac7f0 7 API calls 5993->5996 5995 7ff712fabf3d 5994->5995 5995->5911 5996->5993 6001 7ff712fab999 6000->6001 6003 7ff712faba0c 6000->6003 6002 7ff712fabca0 17 API calls 6001->6002 6001->6003 6004 7ff712faba1c _invalid_parameter_noinfo_noreturn ?uncaught_exception@std@ 6001->6004 6002->6001 6003->5959 6005 7ff712faba43 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 6004->6005 6006 7ff712faba4d 6004->6006 6005->6006 6006->5959 6011 7ff712fab7b0 ?good@ios_base@std@ 6008->6011 6010 7ff712fab803 6012 7ff712fab819 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 ?good@ios_base@std@ 6010->6012 6015 7ff712fab831 6010->6015 6011->6010 6011->6015 6012->6015 6014 7ff712fab88b ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J 6018 7ff712fab8a8 6014->6018 6019 7ff712fab83b ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 6014->6019 6015->6014 6015->6019 6020 7ff712fab865 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD 6015->6020 6016 7ff712fab24f 6022 7ff712faba70 6016->6022 6017 7ff712fab915 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 6017->6016 6018->6019 6021 7ff712fab8ad ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD 6018->6021 6019->6016 6019->6017 6020->6015 6020->6019 6021->6018 6021->6019 6023 7ff712fabaa6 ?good@ios_base@std@ 6022->6023 6025 7ff712fabadf 6023->6025 6026 7ff712fabb0d 6023->6026 6025->6026 6027 7ff712fabaf5 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 ?good@ios_base@std@ 6025->6027 6029 7ff712fabb67 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J 6026->6029 6032 7ff712fabb3b ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD 6026->6032 6034 7ff712fabb17 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 6026->6034 6027->6026 6033 7ff712fabb57 6029->6033 6029->6034 6030 7ff712fabbf1 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 6031 7ff712fab268 6030->6031 6031->5706 6032->6026 6032->6033 6033->6034 6035 7ff712fabb89 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD 6033->6035 6034->6030 6034->6031 6035->6033 6035->6034 6039 7ff712fa623c 6038->6039 6063 7ff712fa6276 6038->6063 6040 7ff712fa6241 GetModuleHandleA 6039->6040 6039->6063 6041 7ff712fa6253 6040->6041 6042 7ff712fa6299 GetProcAddress 6040->6042 6046 7ff712fa5910 9 API calls 6041->6046 6042->6041 6045 7ff712fa62ba 6042->6045 6043 7ff712fae7b0 8 API calls 6044 7ff712fa2527 6043->6044 6044->4739 6047 7ff712fa6397 6045->6047 6048 7ff712fae880 3 API calls 6045->6048 6049 7ff712fa6266 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 6046->6049 6051 7ff712fa2110 9 API calls 6047->6051 6050 7ff712fa62f9 6048->6050 6049->6063 6050->6047 6053 7ff712fa79c0 7 API calls 6050->6053 6052 7ff712fa63c2 6051->6052 6056 7ff712fa21b0 27 API calls 6052->6056 6052->6063 6054 7ff712fa632e 6053->6054 6055 7ff712fa27a0 24 API calls 6054->6055 6057 7ff712fa6343 6055->6057 6058 7ff712fa6416 6056->6058 6059 7ff712fa6385 6057->6059 6061 7ff712fa637e _invalid_parameter_noinfo_noreturn 6057->6061 6062 7ff712fa21b0 27 API calls 6058->6062 6058->6063 6064 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 6059->6064 6061->6059 6062->6063 6063->6043 6067 7ff712fa647f 6066->6067 6091 7ff712fa64b9 6066->6091 6068 7ff712fa6484 GetModuleHandleA 6067->6068 6067->6091 6070 7ff712fa64d3 GetProcAddress 6068->6070 6071 7ff712fa6496 6068->6071 6069 7ff712fae7b0 8 API calls 6072 7ff712fa2654 6069->6072 6070->6071 6073 7ff712fa64f4 6070->6073 6075 7ff712fa5910 9 API calls 6071->6075 6072->4736 6074 7ff712fa65d1 6073->6074 6076 7ff712fae880 3 API calls 6073->6076 6079 7ff712fa2110 9 API calls 6074->6079 6077 7ff712fa64a9 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 6075->6077 6078 7ff712fa6533 6076->6078 6077->6091 6078->6074 6081 7ff712fa79c0 7 API calls 6078->6081 6080 7ff712fa65fc 6079->6080 6083 7ff712fa21b0 27 API calls 6080->6083 6080->6091 6082 7ff712fa6568 6081->6082 6084 7ff712fa27a0 24 API calls 6082->6084 6085 7ff712fa6650 6083->6085 6086 7ff712fa657d 6084->6086 6090 7ff712fa21b0 27 API calls 6085->6090 6085->6091 6087 7ff712fa65bf 6086->6087 6089 7ff712fa65b8 _invalid_parameter_noinfo_noreturn 6086->6089 6092 7ff712fae814 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 6087->6092 6089->6087 6090->6091 6091->6069 6094 7ff712fad3e7 6093->6094 6112 7ff712fad619 6093->6112 6095 7ff712fad64a 6094->6095 6100 7ff712fa7e60 6 API calls 6094->6100 6121 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6095->6121 6096 7ff712fae7b0 8 API calls 6098 7ff712fa1d9c 6096->6098 6098->4748 6098->4750 6101 7ff712fad435 RtlInitUnicodeString 6100->6101 6102 7ff712fad45f 6101->6102 6103 7ff712fad645 6101->6103 6105 7ff712fa7e60 6 API calls 6102->6105 6120 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6103->6120 6106 7ff712fad48c RegOpenKeyW 6105->6106 6107 7ff712fad4bb RegCloseKey GetProcAddress 6106->6107 6111 7ff712fad4b0 6106->6111 6108 7ff712fad4db 6107->6108 6110 7ff712fa73f0 29 API calls 6108->6110 6109 7ff712fad5c4 6109->6112 6115 7ff712fad612 _invalid_parameter_noinfo_noreturn 6109->6115 6113 7ff712fad4f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z 6110->6113 6111->6109 6114 7ff712fad5bd _invalid_parameter_noinfo_noreturn 6111->6114 6112->6096 6116 7ff712fad561 RegDeleteTreeW 6113->6116 6117 7ff712fad51f 6113->6117 6114->6109 6115->6112 6116->6111 6118 7ff712fa73f0 29 API calls 6117->6118 6119 7ff712fad532 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z RegDeleteTreeW 6118->6119 6119->6111 6123 7ff712fa54c0 6122->6123 6123->6123 6124 7ff712fa79c0 7 API calls 6123->6124 6125 7ff712fa54ce 6124->6125 6126 7ff712fa8ac0 6125->6126 6133 7ff712fa8250 6126->6133 6128 7ff712fa8ae8 6148 7ff712fa8bf0 6128->6148 6131 7ff712fa8bc3 6131->4776 6132 7ff712fa8bbc _invalid_parameter_noinfo_noreturn 6132->6131 6134 7ff712fa9df0 6 API calls 6133->6134 6135 7ff712fa8290 6134->6135 6136 7ff712fa82ba 6135->6136 6180 7ff712fa9f10 6135->6180 6138 7ff712fa9f10 10 API calls 6136->6138 6139 7ff712fa82ed 6138->6139 6140 7ff712fa832e __std_exception_copy 6139->6140 6143 7ff712fa8329 6139->6143 6145 7ff712fa8322 _invalid_parameter_noinfo_noreturn 6139->6145 6141 7ff712fa83eb 6140->6141 6142 7ff712fa83bb 6140->6142 6144 7ff712fae7b0 8 API calls 6141->6144 6142->6141 6146 7ff712fa83e4 _invalid_parameter_noinfo_noreturn 6142->6146 6143->6140 6147 7ff712fa8411 6144->6147 6145->6143 6146->6141 6147->6128 6149 7ff712fae050 __std_fs_code_page 2 API calls 6148->6149 6150 7ff712fa8c54 6149->6150 6205 7ff712faa0f0 6150->6205 6153 7ff712faa0f0 27 API calls 6154 7ff712fa8cbc 6153->6154 6155 7ff712fa8d00 6154->6155 6157 7ff712fa8cf2 6154->6157 6158 7ff712fa8d06 6154->6158 6156 7ff712fa9f10 10 API calls 6155->6156 6159 7ff712fa8d6f 6156->6159 6223 7ff712faa250 6157->6223 6158->6155 6162 7ff712fa8d12 memmove 6158->6162 6161 7ff712fa9f10 10 API calls 6159->6161 6163 7ff712fa8d84 6161->6163 6162->6155 6165 7ff712fa8d34 6162->6165 6164 7ff712fa9f10 10 API calls 6163->6164 6166 7ff712fa8d9e 6164->6166 6165->6155 6167 7ff712fa8dfa _invalid_parameter_noinfo_noreturn 6165->6167 6168 7ff712fa8dd1 6166->6168 6169 7ff712fa9f10 10 API calls 6166->6169 6167->6168 6174 7ff712fa8dde 6168->6174 6241 7ff712fa7ac0 6168->6241 6171 7ff712fa8db7 6169->6171 6172 7ff712fa9f10 10 API calls 6171->6172 6172->6168 6173 7ff712fa8e46 6175 7ff712fa8e94 6173->6175 6178 7ff712fa8e8d _invalid_parameter_noinfo_noreturn 6173->6178 6174->6173 6176 7ff712fa8e3f _invalid_parameter_noinfo_noreturn 6174->6176 6177 7ff712fae7b0 8 API calls 6175->6177 6176->6173 6179 7ff712fa8b82 6177->6179 6178->6175 6179->6131 6179->6132 6181 7ff712fa9f72 6180->6181 6182 7ff712fa9f33 memmove 6180->6182 6186 7ff712faa530 6181->6186 6182->6136 6185 7ff712fa9f85 6185->6136 6187 7ff712faa6b2 6186->6187 6188 7ff712faa55e 6186->6188 6204 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6187->6204 6189 7ff712faa5be 6188->6189 6192 7ff712faa5b1 6188->6192 6193 7ff712faa5ea 6188->6193 6194 7ff712fae8f8 std::_Facet_Register 3 API calls 6189->6194 6191 7ff712faa6b7 6196 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 6191->6196 6192->6189 6192->6191 6195 7ff712faa5d3 6193->6195 6198 7ff712fae8f8 std::_Facet_Register 3 API calls 6193->6198 6194->6195 6197 7ff712faa66b _invalid_parameter_noinfo_noreturn 6195->6197 6200 7ff712faa672 memmove memmove 6195->6200 6201 7ff712faa61e memmove memmove 6195->6201 6199 7ff712faa6bd 6196->6199 6197->6200 6198->6195 6203 7ff712faa65e 6200->6203 6202 7ff712faa649 6201->6202 6201->6203 6202->6197 6202->6203 6203->6185 6206 7ff712fa8c89 6205->6206 6208 7ff712faa140 6205->6208 6206->6153 6207 7ff712faa231 6210 7ff712fa8570 12 API calls 6207->6210 6208->6207 6258 7ff712fae19c WideCharToMultiByte 6208->6258 6212 7ff712faa237 6210->6212 6213 7ff712fa8840 11 API calls 6212->6213 6216 7ff712faa243 6213->6216 6214 7ff712faa1d3 6218 7ff712faa3a0 9 API calls 6214->6218 6215 7ff712faa1ac memset 6219 7ff712faa180 6215->6219 6218->6219 6220 7ff712fae19c 4 API calls 6219->6220 6221 7ff712faa200 6220->6221 6221->6206 6222 7ff712fa8840 11 API calls 6221->6222 6222->6207 6224 7ff712faa279 6223->6224 6225 7ff712faa38c 6223->6225 6227 7ff712faa2c7 6224->6227 6230 7ff712faa2d4 6224->6230 6231 7ff712faa2fc 6224->6231 6264 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6225->6264 6229 7ff712faa391 6227->6229 6227->6230 6228 7ff712fae8f8 std::_Facet_Register 3 API calls 6232 7ff712faa2e9 6228->6232 6233 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 6229->6233 6230->6228 6231->6232 6235 7ff712fae8f8 std::_Facet_Register 3 API calls 6231->6235 6234 7ff712faa35f _invalid_parameter_noinfo_noreturn 6232->6234 6237 7ff712faa366 memmove 6232->6237 6238 7ff712faa325 memmove 6232->6238 6236 7ff712faa397 6233->6236 6234->6237 6235->6232 6240 7ff712faa352 6237->6240 6239 7ff712faa33d 6238->6239 6238->6240 6239->6234 6239->6240 6240->6155 6242 7ff712fa7aef 6241->6242 6243 7ff712fa7c14 6241->6243 6245 7ff712fa7b4a 6242->6245 6248 7ff712fa7b72 6242->6248 6249 7ff712fa7b3d 6242->6249 6265 7ff712fa11d0 ?_Xlength_error@std@@YAXPEBD 6243->6265 6247 7ff712fae8f8 std::_Facet_Register 3 API calls 6245->6247 6246 7ff712fa7c19 6251 7ff712fa1130 Concurrency::cancel_current_task __std_exception_copy 6246->6251 6250 7ff712fa7b5f 6247->6250 6248->6250 6253 7ff712fae8f8 std::_Facet_Register 3 API calls 6248->6253 6249->6245 6249->6246 6252 7ff712fa7bdd _invalid_parameter_noinfo_noreturn 6250->6252 6254 7ff712fa7b9a memmove 6250->6254 6257 7ff712fa7bd0 6250->6257 6255 7ff712fa7c1f 6251->6255 6252->6257 6253->6250 6256 7ff712fa7bbb 6254->6256 6254->6257 6255->6174 6256->6252 6256->6257 6257->6174 6259 7ff712fae1f3 GetLastError 6258->6259 6260 7ff712fae1fb 6258->6260 6259->6260 6261 7ff712faa165 6260->6261 6262 7ff712fae208 WideCharToMultiByte 6260->6262 6261->6212 6261->6214 6261->6215 6261->6219 6262->6261 6263 7ff712fae236 GetLastError 6262->6263 6263->6261 6348 7ff712fafb38 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N 6466 7ff712faf7bc 6467 7ff712faf7f4 __GSHandlerCheckCommon 6466->6467 6468 7ff712faf80f __CxxFrameHandler4 6467->6468 6469 7ff712faf820 6467->6469 6468->6469 6349 7ff712fa5050 6350 7ff712fa5076 6349->6350 6352 7ff712fa507d 6349->6352 6351 7ff712fae7b0 8 API calls 6350->6351 6353 7ff712fa51f6 6351->6353 6352->6350 6354 7ff712fa5103 fputc 6352->6354 6355 7ff712fa5125 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD 6352->6355 6354->6350 6356 7ff712fa5194 6355->6356 6357 7ff712fa516a 6355->6357 6356->6350 6358 7ff712fa51a3 fwrite 6356->6358 6357->6356 6359 7ff712fa516f 6357->6359 6358->6350 6359->6350 6360 7ff712fa5174 fputc 6359->6360 6360->6350 6361 7ff712fa5250 6362 7ff712fa526d 6361->6362 6363 7ff712fa52aa ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA 6362->6363 6364 7ff712fa56e0 12 API calls 6362->6364 6364->6363 6470 7ff712fa53d0 6471 7ff712fa53e3 6470->6471 6472 7ff712fa540c 6470->6472 6471->6472 6473 7ff712fa542b _invalid_parameter_noinfo_noreturn 6471->6473 6365 7ff712fab950 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 6366 7ff712fafd50 ??1_Lockit@std@@QEAA 6474 7ff712fa8ed0 6475 7ff712fa8ef1 6474->6475 6476 7ff712fa8fc3 __std_exception_destroy 6475->6476 6477 7ff712fa900d _invalid_parameter_noinfo_noreturn 6475->6477 6478 7ff712fa8fbb 6475->6478 6479 7ff712fa8fed 6476->6479 6481 7ff712fa903a 6477->6481 6478->6476 6480 7ff712fa913b _invalid_parameter_noinfo_noreturn __std_exception_copy 6483 7ff712fa91ac 6480->6483 6481->6480 6482 7ff712fa910c __std_exception_destroy 6481->6482 6482->6480 6484 7ff712fa9df0 6 API calls 6483->6484 6485 7ff712fa91c8 6484->6485 6367 7ff712faee54 6368 7ff712faee64 6367->6368 6380 7ff712fae9bc 6368->6380 6370 7ff712faf350 9 API calls 6371 7ff712faef09 6370->6371 6372 7ff712faee88 _RTC_Initialize 6378 7ff712faeeeb 6372->6378 6388 7ff712faf61c InitializeSListHead 6372->6388 6378->6370 6379 7ff712faeef9 6378->6379 6381 7ff712fae9ff 6380->6381 6382 7ff712fae9cd 6380->6382 6381->6372 6383 7ff712faea3c 6382->6383 6386 7ff712fae9d2 __scrt_acquire_startup_lock 6382->6386 6384 7ff712faf350 9 API calls 6383->6384 6385 7ff712faea46 6384->6385 6386->6381 6387 7ff712fae9ef _initialize_onexit_table 6386->6387 6387->6381 6486 7ff712fa10e0 __std_exception_destroy 6487 7ff712fa46e0 6488 7ff712fa4720 6487->6488 6489 7ff712fa46f3 6487->6489 6489->6488 6490 7ff712fa4703 fflush 6489->6490 6491 7ff712fa54e0 6492 7ff712fa5503 6491->6492 6493 7ff712fa553e ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA 6492->6493 6494 7ff712fa56e0 12 API calls 6492->6494 6495 7ff712fa554e 6493->6495 6494->6493 6389 7ff712fae760 DeleteCriticalSection 6390 7ff712fae77c 6389->6390 6496 7ff712fafde0 6497 7ff712fafe00 6496->6497 6498 7ff712fafdf3 6496->6498 6499 7ff712fa5440 _invalid_parameter_noinfo_noreturn 6498->6499 6499->6497 6391 7ff712faf066 6392 7ff712faf4a8 GetModuleHandleW 6391->6392 6393 7ff712faf06d 6392->6393 6394 7ff712faf071 6393->6394 6395 7ff712faf0ac _exit 6393->6395 6396 7ff712fb0164 _seh_filter_exe 6500 7ff712fae7d8 AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable 4371 7ff712fa5af0 ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12 6397 7ff712fa4f70 6398 7ff712fa4f8b 6397->6398 6399 7ff712fa4fd9 ungetc 6398->6399 6400 7ff712fa4fa1 6398->6400 6399->6400 6401 7ff712fa5570 6402 7ff712fa2050 15 API calls 6401->6402 6403 7ff712fa558b 6402->6403 6501 7ff712fa4af0 6502 7ff712fa4b12 6501->6502 6503 7ff712fa4b07 6501->6503 6504 7ff712fa4b28 6502->6504 6505 7ff712fa4b19 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J 6502->6505 6506 7ff712fa4b4d memmove 6504->6506 6508 7ff712fa4b82 6504->6508 6505->6504 6506->6508 6507 7ff712fa4c1e 6508->6507 6509 7ff712fa4bfe 6508->6509 6510 7ff712fa4bd0 fread 6508->6510 6509->6507 6511 7ff712fa4c03 fread 6509->6511 6510->6507 6510->6508 6511->6507 6524 7ff712fafaee ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA 6404 7ff712fa5a80 6405 7ff712fa5a8e ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N ?uncaught_exception@std@ 6404->6405 6406 7ff712fa5ab8 6405->6406 6407 7ff712fa5aae ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@ 6405->6407 6407->6406 6408 7ff712fa8680 ?_Syserror_map@std@@YAPEBDH 6409 7ff712fa86b0 6408->6409 6409->6409 6410 7ff712fa79c0 7 API calls 6409->6410 6411 7ff712fa86c5 6410->6411 6414 7ff712fa1090 __std_exception_destroy 6415 7ff712fa10b8 6414->6415 6416 7ff712fa4690 6417 7ff712fa7660 18 API calls 6416->6417 6418 7ff712fa46a5 ?always_noconv@codecvt_base@std@ 6417->6418 6419 7ff712fa46b5 6418->6419 6420 7ff712fa46c8 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@ 6418->6420 6530 7ff712fa4910 6531 7ff712fa4943 6530->6531 6532 7ff712fa55f0 10 API calls 6531->6532 6538 7ff712fa49a1 6531->6538 6534 7ff712fa4966 6532->6534 6533 7ff712fae7b0 8 API calls 6535 7ff712fa4a0b 6533->6535 6536 7ff712fa4974 _fseeki64 6534->6536 6537 7ff712fa498b fgetpos 6534->6537 6534->6538 6536->6537 6536->6538 6537->6538 6538->6533 6539 7ff712fa5210 6540 7ff712fa5223 6539->6540 6541 7ff712fa521c _unlock_file 6539->6541 6541->6540 6422 7ff712fafe90 6423 7ff712fafeb0 6422->6423 6424 7ff712fafea3 6422->6424 6426 7ff712fa5440 6424->6426 6427 7ff712fa5453 6426->6427 6429 7ff712fa5477 6426->6429 6428 7ff712fa5498 _invalid_parameter_noinfo_noreturn 6427->6428 6427->6429 6429->6423 6430 7ff712fadb90 6431 7ff712fad8a0 15 API calls 6430->6431 6432 7ff712fadbab 6431->6432 6542 7ff712fa8710 6549 7ff712fadfb4 GetLocaleInfoEx FormatMessageA 6542->6549 6545 7ff712fa79c0 7 API calls 6546 7ff712fa877a LocalFree 6545->6546 6547 7ff712fae7b0 8 API calls 6546->6547 6548 7ff712fa8795 6547->6548 6550 7ff712fa8745 6549->6550 6550->6545 6552 7ff712fa100c 6555 7ff712fae6b8 6552->6555 6554 7ff712fa101c 6556 7ff712fae6d3 6555->6556 6557 7ff712fae748 6556->6557 6558 7ff712fae719 GetLastError 6556->6558 6557->6554 6558->6557 6559 7ff712fae731 IsDebuggerPresent 6558->6559 6559->6557 6560 7ff712fae73b OutputDebugStringW 6559->6560 6560->6557 6561 7ff712fb000c 6562 7ff712fab990 20 API calls 6561->6562 6563 7ff712fb0026 6562->6563 6570 7ff712fab510 6563->6570 6571 7ff712fab524 _invalid_parameter_noinfo_noreturn 6570->6571

    Executed Functions

    Function 00007FF712FA9330 Relevance: 70.7, APIs: 25, Strings: 15, Instructions: 688COMMON
    Download Yara Rule
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF712FA9373
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA93BB
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA93FB
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA946B
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA94AB
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA951B
    • _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF712FA955B
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?), ref: 00007FF712FA95B2
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?), ref: 00007FF712FA95DA
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?), ref: 00007FF712FA9601
    • __std_fs_code_page.MSVCPRT ref: 00007FF712FA9766
    • memcmp.VCRUNTIME140(?), ref: 00007FF712FA97B1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?), ref: 00007FF712FA98EE
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA9911
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00007FF712FA9949
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00007FF712FA9950
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00007FF712FA9957
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00007FF712FA9AB4
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?), ref: 00007FF712FA9B1B
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00007FF712FA9B65
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA9C3D
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA9CBF
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA9CE2
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA9D16
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA9DE1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@W@std@@@std@@$_invalid_parameter_noinfo_noreturn$_wcsicmp$ExceptionFilterUnhandled__std_fs_code_pagememcmp
    • String ID: [!] Incorrect Usage!$ doesn't exist$.sys$PassAllocationPtr$[+] Free pool memory after usage enabled$[+] Mdl memory usage enabled$[+] Pass Allocation Ptr as first param enabled$[+] Usage: kdmapper.exe [--free][--mdl][--PassAllocationPtr] driver$[+] success$[-] Failed to map $[-] Failed to read image to memory$[-] File $[-] Warning failed to fully unload vulnerable driver $free$mdl
    • API String ID: 479729990-1302835770
    • Opcode ID: 57c9e28aabbb2cddc90e3a9a9f23a01467ab4f27a87d17974de18547fb2a9fe5
    • Instruction ID: 71d0f326a3871e4a4710e1cf09d1f700d0ce6af6cd21b12f07ebc1da3029d053
    • Opcode Fuzzy Hash: 57c9e28aabbb2cddc90e3a9a9f23a01467ab4f27a87d17974de18547fb2a9fe5
    • Instruction Fuzzy Hash: 9E52A466F18E4685EF50AB25D4442B9A3A9FF44BB4FD06631DA1E036D4DFBCE588C320
    Function 00007FF712FA5910 Relevance: 13.6, APIs: 9, Instructions: 138COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 226 7ff712fa5910-7ff712fa593f 227 7ff712fa5940-7ff712fa5948 226->227 227->227 228 7ff712fa594a-7ff712fa5959 227->228 229 7ff712fa5965 228->229 230 7ff712fa595b-7ff712fa595e 228->230 231 7ff712fa5967-7ff712fa5977 229->231 230->229 232 7ff712fa5960-7ff712fa5963 230->232 233 7ff712fa5980-7ff712fa5992 ?good@ios_base@std@@QEBA_NXZ 231->233 234 7ff712fa5979-7ff712fa597f 231->234 232->231 235 7ff712fa59c4-7ff712fa59ca 233->235 236 7ff712fa5994-7ff712fa59a3 233->236 234->233 240 7ff712fa59d6-7ff712fa59ef 235->240 241 7ff712fa59cc-7ff712fa59d1 235->241 238 7ff712fa59c2 236->238 239 7ff712fa59a5-7ff712fa59a8 236->239 238->235 239->238 242 7ff712fa59aa-7ff712fa59c0 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ 239->242 244 7ff712fa5a1f-7ff712fa5a3a ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z 240->244 245 7ff712fa59f1-7ff712fa59f4 240->245 243 7ff712fa5a8e-7ff712fa5aac ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?uncaught_exception@std@@YA_NXZ 241->243 242->235 246 7ff712fa5ab8-7ff712fa5ac8 243->246 247 7ff712fa5aae-7ff712fa5ab7 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ 243->247 248 7ff712fa5a67 244->248 249 7ff712fa5a3c 244->249 245->244 250 7ff712fa59f6-7ff712fa5a11 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z 245->250 251 7ff712fa5ad1-7ff712fa5aeb 246->251 252 7ff712fa5aca-7ff712fa5ad0 246->252 247->246 254 7ff712fa5a6a 248->254 253 7ff712fa5a40-7ff712fa5a43 249->253 255 7ff712fa5a13-7ff712fa5a18 250->255 256 7ff712fa5a1a-7ff712fa5a1d 250->256 252->251 257 7ff712fa5a45-7ff712fa5a60 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z 253->257 258 7ff712fa5a6e-7ff712fa5a7e 253->258 254->258 255->254 256->245 257->248 260 7ff712fa5a62-7ff712fa5a65 257->260 258->243 260->253
    APIs
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A07
    • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A31
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A56
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
    • ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
    • ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
    • String ID:
    • API String ID: 1647946921-0
    • Opcode ID: 0a2b1289ed850ce5a6cc45d9a0cf48bc558de9ab1d5187c6e46add9a75fe4373
    • Instruction ID: 5076526ecd0e43339a30354a47cde6d2c8d4a7876794f4fde2468898f3541e95
    • Opcode Fuzzy Hash: 0a2b1289ed850ce5a6cc45d9a0cf48bc558de9ab1d5187c6e46add9a75fe4373
    • Instruction Fuzzy Hash: 47512E22B08E4181EB60AF19E594239E7A4FB88FA5F95D531CE4E47BA0CF79D54AC310
    Function 00007FF712FAEF38 Relevance: 13.6, APIs: 9, Instructions: 94COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: __p___argc__p___wargv__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_release_startup_lock_cexit_exit_get_initial_wide_environment_register_thread_local_exe_atexit_callback
    • String ID:
    • API String ID: 1184979102-0
    • Opcode ID: 31e9bd74f2649d3bc3b452098acaf2e171843a3001b2598f79c46f2741660a67
    • Instruction ID: 97c4c580546b639c38e80fe23d2af059bb72efcd6f70d2be74ec4f2056ed9cac
    • Opcode Fuzzy Hash: 31e9bd74f2649d3bc3b452098acaf2e171843a3001b2598f79c46f2741660a67
    • Instruction Fuzzy Hash: 30314021E08E0742FA90BB2494563BA9399AF55FA4FC46534E54E0B2D3DEEEA44CC670
    Function 00007FF712FA5AF0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF712FA5B05
    • ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF712FA5B11
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FA5B1A
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@?put@?$basic_ostream@_?widen@?$basic_ios@_D@std@@@std@@U?$char_traits@V12@V12@_
    • String ID:
    • API String ID: 1552636710-0
    • Opcode ID: a161826a73a96f399066167084e507513aae689c47126b9b20167b9a9b21591e
    • Instruction ID: 91a64c9e2ae7cf91d5b6bcc858ebc142c70b5c00347f7adcf478f708167bfed5
    • Opcode Fuzzy Hash: a161826a73a96f399066167084e507513aae689c47126b9b20167b9a9b21591e
    • Instruction Fuzzy Hash: 77D01714A84A0682DE08AF26B8941396365AF8DFA2F8CA030CD0F87310CE3CD199C624

    Non-executed Functions

    Function 00007FF712FA3CF0 Relevance: 82.8, APIs: 22, Strings: 25, Instructions: 590COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FAD960: NtQuerySystemInformation.NTDLL ref: 00007FF712FAD993
      • Part of subcall function 00007FF712FAD960: VirtualFree.KERNEL32 ref: 00007FF712FAD9B0
      • Part of subcall function 00007FF712FAD960: VirtualAlloc.KERNEL32 ref: 00007FF712FAD9C6
      • Part of subcall function 00007FF712FAD960: NtQuerySystemInformation.NTDLL ref: 00007FF712FAD9E1
      • Part of subcall function 00007FF712FAD960: VirtualFree.KERNEL32 ref: 00007FF712FADA02
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA3D8A
      • Part of subcall function 00007FF712FA2110: DeviceIoControl.KERNEL32 ref: 00007FF712FA2178
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA3DFF
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA3EA0
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF712FA3F78
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA3F84
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA3FD2
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA4014
      • Part of subcall function 00007FF712FA2FE0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,-0000000A,00007FF712FA3913), ref: 00007FF712FA30AA
      • Part of subcall function 00007FF712FA2FE0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,-0000000A,00007FF712FA3913), ref: 00007FF712FA30EA
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA405E
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA4090
      • Part of subcall function 00007FF712FA5910: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A07
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA3F94
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA4651
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@_$V01@@$Virtual$?good@ios_base@std@@D@std@@@std@@FreeInformationQuerySystemU?$char_traits@_invalid_parameter_noinfo_noreturn$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputc@?$basic_streambuf@_?uncaught_exception@std@@AllocControlDeviceOsfx@?$basic_ostream@V12@V21@@Vios_base@1@memmove
    • String ID: [!] g_KernelHashBucketList looks empty!$[+] Found In g_KernelHashBucketList: $[+] g_HashCacheLock Locked$[+] g_KernelHashBucketList Cleaned$[+] g_KernelHashBucketList Found 0x$[-] Can't Find ci.dll module address$[-] Can't Find g_HashCache relative address$[-] Can't Find g_HashCacheLock$[-] Can't Find g_KernelHashBucketList$[-] Can't find pattern$[-] Can't lock g_HashCacheLock$[-] Failed to clear g_KernelHashBucketList entry pool!$[-] Failed to read first g_KernelHashBucketList entry!$[-] Failed to read g_KernelHashBucketList entry text len!$[-] Failed to read g_KernelHashBucketList entry text ptr!$[-] Failed to read g_KernelHashBucketList entry text!$[-] Failed to read g_KernelHashBucketList next entry ptr!$[-] Failed to read g_KernelHashBucketList next entry!$[-] Failed to release g_KernelHashBucketList lock!$[-] Failed to write g_KernelHashBucketList prev entry ptr!$[-] No module address to find pattern$[-] Read failed in FindPatternAtKernel$ci.dll$xxx$xxx????x?xxxxxxx
    • API String ID: 1342546852-3908567482
    • Opcode ID: afd65226d629bb2cd274d8e656f883520e6269e3721f0ef54ea5a21282dcdcfc
    • Instruction ID: d71be21c5c183530598cacd0c2bcabfb4c0bfa43dbf361f07f7f8bba8c0871fc
    • Opcode Fuzzy Hash: afd65226d629bb2cd274d8e656f883520e6269e3721f0ef54ea5a21282dcdcfc
    • Instruction Fuzzy Hash: 0C428B65F18E4280FE80AB65E8442B9A369FF45BA4FD06131DE4D17A99DFBCE54CC320
    Function 00007FF712FA1800 Relevance: 65.0, APIs: 23, Strings: 14, Instructions: 295filethreadCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 640 7ff712fa1800-7ff712fa1887 _time64 GetCurrentThreadId srand CreateFileW 641 7ff712fa18c1-7ff712fa1924 rand 640->641 642 7ff712fa1889-7ff712fa18bc CloseHandle call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 640->642 644 7ff712fa1971-7ff712fa199b call 7ff712fa5910 call 7ff712fa12e0 641->644 645 7ff712fa1926-7ff712fa1939 641->645 649 7ff712fa1cf0-7ff712fa1d1b call 7ff712fae7b0 642->649 655 7ff712fa19a0-7ff712fa19c5 call 7ff712fa7fa0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 644->655 656 7ff712fa199d 644->656 647 7ff712fa1940-7ff712fa196f rand 645->647 647->644 647->647 659 7ff712fa1a01-7ff712fa1a12 call 7ff712fa1500 655->659 660 7ff712fa19c7-7ff712fa19de 655->660 656->655 667 7ff712fa1a14 659->667 668 7ff712fa1a3c-7ff712fa1aac _wremove memset call 7ff712fa52c0 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ 659->668 661 7ff712fa19e0-7ff712fa19f3 660->661 662 7ff712fa19fc call 7ff712fae7d0 660->662 661->662 664 7ff712fa19f5-7ff712fa19fb _invalid_parameter_noinfo_noreturn 661->664 662->659 664->662 670 7ff712fa1a1b-7ff712fa1a37 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 667->670 673 7ff712fa1aea-7ff712fa1af2 call 7ff712fa56e0 668->673 674 7ff712fa1aae-7ff712fa1ab6 call 7ff712fa56e0 668->674 676 7ff712fa1ca1 670->676 686 7ff712fa1b11-7ff712fa1b26 call 7ff712fa2050 call 7ff712facf50 673->686 687 7ff712fa1af4-7ff712fa1b10 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z 673->687 682 7ff712fa1ad5-7ff712fa1ae5 call 7ff712fa2050 674->682 683 7ff712fa1ab8-7ff712fa1ad4 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z 674->683 680 7ff712fa1ca8-7ff712fa1cb1 676->680 684 7ff712fa1cb3-7ff712fa1cca 680->684 685 7ff712fa1ced 680->685 682->670 683->682 689 7ff712fa1ce8 call 7ff712fae7d0 684->689 690 7ff712fa1ccc-7ff712fa1cdf 684->690 685->649 698 7ff712fa1b28-7ff712fa1b62 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _wremove 686->698 699 7ff712fa1b67-7ff712fa1ba2 CreateFileW 686->699 687->686 689->685 690->689 694 7ff712fa1ce1-7ff712fa1ce7 _invalid_parameter_noinfo_noreturn 690->694 694->689 698->676 701 7ff712fa1c76 699->701 702 7ff712fa1ba8-7ff712fa1beb call 7ff712fa79c0 call 7ff712fad960 699->702 703 7ff712fa1c7d-7ff712fa1c9c call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa1d20 701->703 712 7ff712fa1c29-7ff712fa1c2c 702->712 713 7ff712fa1bed-7ff712fa1bff 702->713 703->676 714 7ff712fa1c37-7ff712fa1c41 call 7ff712fa3300 712->714 715 7ff712fa1c2e-7ff712fa1c35 712->715 716 7ff712fa1c01-7ff712fa1c14 713->716 717 7ff712fa1c1d-7ff712fa1c22 call 7ff712fae7d0 713->717 723 7ff712fa1c43-7ff712fa1c4a 714->723 724 7ff712fa1c4c-7ff712fa1c56 call 7ff712fa3cf0 714->724 715->703 716->717 720 7ff712fa1c16-7ff712fa1c1c _invalid_parameter_noinfo_noreturn 716->720 717->712 720->717 723->703 727 7ff712fa1c61-7ff712fa1c6b call 7ff712fa2ae0 724->727 728 7ff712fa1c58-7ff712fa1c5f 724->728 727->680 731 7ff712fa1c6d-7ff712fa1c74 727->731 728->703 731->703
    APIs
    • _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF712FA1837
    • GetCurrentThreadId.KERNEL32 ref: 00007FF712FA1840
    • srand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF712FA184B
    • CreateFileW.KERNEL32 ref: 00007FF712FA1879
    • CloseHandle.KERNEL32 ref: 00007FF712FA188C
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA18AF
    • rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF712FA18F6
    • rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF712FA1940
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA19B5
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA19F5
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA1A31
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@_V01@@$?good@ios_base@std@@D@std@@@std@@U?$char_traits@rand$?flush@?$basic_ostream@?setstate@?$basic_ios@_?uncaught_exception@std@@CloseCreateCurrentFileHandleOsfx@?$basic_ostream@ThreadV12@_invalid_parameter_noinfo_noreturn_time64srand
    • String ID: [!] Failed to ClearMmUnloadedDrivers$[-] Can't find TEMP folder$[-] Failed to ClearKernelHashBucketList$[-] Failed to ClearPiDDBCacheTable$[-] Failed to create vulnerable driver file$[-] Failed to get ntoskrnl.exe$[-] Failed to get temp path$[-] Failed to load driver iqvw64e.sys$[-] Failed to register and start service for the vulnerable driver$[-] \Device\Nal is already in use.$[<] Loading vulnerable driver, Name: $\\.\Nal$gfff$ntoskrnl.exe
    • API String ID: 4132331485-3036430678
    • Opcode ID: 0687670a019a20a180e0959560c5c898c898dec2eb1374ec2884c1a41fd044f8
    • Instruction ID: c7c2aef99b111ec5e35ffd7afdc5448d3326315d893bd73c7b096713c1635085
    • Opcode Fuzzy Hash: 0687670a019a20a180e0959560c5c898c898dec2eb1374ec2884c1a41fd044f8
    • Instruction Fuzzy Hash: F7E18225E18E4281FB40EB25E8542BAA369FF85BF4FC05231D95E426A5DFBCE54CC720
    Function 00007FF712FAE268 Relevance: 33.2, APIs: 22, Instructions: 224fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1056 7ff712fae268-7ff712fae2a8 1057 7ff712fae2aa-7ff712fae2b1 1056->1057 1058 7ff712fae2bd-7ff712fae2c6 1056->1058 1057->1058 1059 7ff712fae2b3-7ff712fae2b8 1057->1059 1060 7ff712fae2e2-7ff712fae2e4 1058->1060 1061 7ff712fae2c8-7ff712fae2cb 1058->1061 1065 7ff712fae546-7ff712fae56c call 7ff712fae7b0 1059->1065 1063 7ff712fae544 1060->1063 1064 7ff712fae2ea-7ff712fae2ee 1060->1064 1061->1060 1062 7ff712fae2cd-7ff712fae2d5 1061->1062 1066 7ff712fae2d7-7ff712fae2d9 1062->1066 1067 7ff712fae2db-7ff712fae2de 1062->1067 1063->1065 1069 7ff712fae3c5-7ff712fae3ec call 7ff712fae590 1064->1069 1070 7ff712fae2f4-7ff712fae2f7 1064->1070 1066->1060 1066->1067 1067->1060 1079 7ff712fae40e-7ff712fae417 1069->1079 1080 7ff712fae3ee-7ff712fae3f7 1069->1080 1073 7ff712fae2f9-7ff712fae301 1070->1073 1074 7ff712fae30b-7ff712fae31d GetFileAttributesExW 1070->1074 1073->1074 1076 7ff712fae303-7ff712fae305 1073->1076 1077 7ff712fae31f-7ff712fae328 GetLastError 1074->1077 1078 7ff712fae370-7ff712fae37f 1074->1078 1076->1069 1076->1074 1077->1065 1081 7ff712fae32e-7ff712fae340 FindFirstFileW 1077->1081 1082 7ff712fae383-7ff712fae385 1078->1082 1085 7ff712fae4cf-7ff712fae4d8 1079->1085 1086 7ff712fae41d-7ff712fae435 GetFileInformationByHandleEx 1079->1086 1083 7ff712fae3f9-7ff712fae401 CloseHandle 1080->1083 1084 7ff712fae407-7ff712fae409 1080->1084 1087 7ff712fae342-7ff712fae348 GetLastError 1081->1087 1088 7ff712fae34d-7ff712fae36e FindClose 1081->1088 1089 7ff712fae391-7ff712fae3bf 1082->1089 1090 7ff712fae387-7ff712fae38f 1082->1090 1083->1084 1091 7ff712fae580-7ff712fae586 terminate 1083->1091 1084->1065 1092 7ff712fae4da-7ff712fae4ee GetFileInformationByHandleEx 1085->1092 1093 7ff712fae52d-7ff712fae52f 1085->1093 1094 7ff712fae460-7ff712fae479 1086->1094 1095 7ff712fae437-7ff712fae443 GetLastError 1086->1095 1087->1065 1088->1082 1089->1063 1089->1069 1090->1069 1090->1089 1096 7ff712fae587-7ff712fae58c 1091->1096 1097 7ff712fae4f0-7ff712fae4fc GetLastError 1092->1097 1098 7ff712fae51a-7ff712fae52a 1092->1098 1101 7ff712fae531-7ff712fae535 1093->1101 1102 7ff712fae56d-7ff712fae571 1093->1102 1094->1085 1103 7ff712fae47b-7ff712fae47f 1094->1103 1099 7ff712fae445-7ff712fae450 CloseHandle 1095->1099 1100 7ff712fae459-7ff712fae45b 1095->1100 1096->1065 1097->1100 1105 7ff712fae502-7ff712fae50d CloseHandle 1097->1105 1098->1093 1099->1100 1106 7ff712fae452-7ff712fae458 terminate 1099->1106 1100->1065 1101->1063 1107 7ff712fae537-7ff712fae542 CloseHandle 1101->1107 1102->1096 1104 7ff712fae573-7ff712fae57e CloseHandle 1102->1104 1108 7ff712fae481-7ff712fae49b GetFileInformationByHandleEx 1103->1108 1109 7ff712fae4c8 1103->1109 1104->1091 1104->1096 1105->1100 1113 7ff712fae513-7ff712fae519 terminate 1105->1113 1106->1100 1107->1063 1107->1091 1110 7ff712fae4bf-7ff712fae4c6 1108->1110 1111 7ff712fae49d-7ff712fae4a9 GetLastError 1108->1111 1112 7ff712fae4cc 1109->1112 1110->1112 1111->1100 1114 7ff712fae4ab-7ff712fae4b6 CloseHandle 1111->1114 1112->1085 1113->1098 1114->1100 1115 7ff712fae4b8-7ff712fae4be terminate 1114->1115 1115->1110
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handleterminate
    • String ID:
    • API String ID: 2940733389-0
    • Opcode ID: 15296d6e40f6d123f720c5c9f9da8d40ae474e78b95cf03cab7fbfd31c63b516
    • Instruction ID: f7ee3fac9038b682e6dcaca59604c28ef6daff532edad1ed7223adda2560b79b
    • Opcode Fuzzy Hash: 15296d6e40f6d123f720c5c9f9da8d40ae474e78b95cf03cab7fbfd31c63b516
    • Instruction Fuzzy Hash: 8D91B431A08E4246E7A4AF15A84467AA3A9AF44FB4F981731D97E437D4DFBCE50CC720
    Function 00007FF712FA2AE0 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 217nativememoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1116 7ff712fa2ae0-7ff712fa2b27 NtQuerySystemInformation 1117 7ff712fa2b76-7ff712fa2b88 1116->1117 1118 7ff712fa2b29 1116->1118 1120 7ff712fa2e3c-7ff712fa2e3f 1117->1120 1121 7ff712fa2b8e-7ff712fa2b91 1117->1121 1119 7ff712fa2b30-7ff712fa2b74 VirtualFree VirtualAlloc NtQuerySystemInformation 1118->1119 1119->1117 1119->1119 1122 7ff712fa2e52 1120->1122 1123 7ff712fa2e41-7ff712fa2e4c VirtualFree 1120->1123 1121->1122 1124 7ff712fa2b97-7ff712fa2ba0 1121->1124 1127 7ff712fa2e54-7ff712fa2e83 call 7ff712fae7b0 1122->1127 1123->1122 1125 7ff712fa2ba2-7ff712fa2ba5 1124->1125 1126 7ff712fa2c09-7ff712fa2c1d VirtualFree 1124->1126 1129 7ff712fa2bb0-7ff712fa2bee GetCurrentProcessId 1125->1129 1126->1122 1128 7ff712fa2c23-7ff712fa2c3f call 7ff712fa2110 1126->1128 1138 7ff712fa2e30-7ff712fa2e37 1128->1138 1139 7ff712fa2c45-7ff712fa2c4c 1128->1139 1132 7ff712fa2bf0-7ff712fa2bf4 1129->1132 1133 7ff712fa2bf6-7ff712fa2bfd 1129->1133 1132->1133 1136 7ff712fa2c04 1132->1136 1133->1129 1137 7ff712fa2bff 1133->1137 1136->1126 1137->1123 1141 7ff712fa2d3a-7ff712fa2d56 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1138->1141 1139->1138 1140 7ff712fa2c52-7ff712fa2c6e call 7ff712fa2110 1139->1140 1146 7ff712fa2e24-7ff712fa2e2b 1140->1146 1147 7ff712fa2c74-7ff712fa2c7b 1140->1147 1141->1122 1146->1141 1147->1146 1148 7ff712fa2c81-7ff712fa2c9d call 7ff712fa2110 1147->1148 1151 7ff712fa2ca3-7ff712fa2caa 1148->1151 1152 7ff712fa2e18-7ff712fa2e1f 1148->1152 1151->1152 1153 7ff712fa2cb0-7ff712fa2ccf call 7ff712fa2110 1151->1153 1152->1141 1156 7ff712fa2cd5-7ff712fa2cdc 1153->1156 1157 7ff712fa2e0c-7ff712fa2e13 1153->1157 1156->1157 1158 7ff712fa2ce2-7ff712fa2d31 call 7ff712faeb84 memset call 7ff712fa2110 1156->1158 1157->1141 1163 7ff712fa2d33 1158->1163 1164 7ff712fa2d5b-7ff712fa2d68 1158->1164 1163->1141 1165 7ff712fa2e00-7ff712fa2e07 1164->1165 1166 7ff712fa2d6e-7ff712fa2dc4 DeviceIoControl 1164->1166 1165->1141 1166->1165 1167 7ff712fa2dc6-7ff712fa2dfe call 7ff712fa5910 * 2 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fae7d0 1166->1167 1167->1127
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@Virtual$Free$??6?$basic_ostream@_InformationQuerySystemU?$char_traits@_V01@@W@std@@@std@@$AllocControlCurrentDeviceProcessmemset
    • String ID: [!] Failed to find device_object$[!] Failed to find driver name$[!] Failed to find driver_object$[!] Failed to find driver_section$[!] Failed to read driver name$[!] Failed to write driver name length$[+] MmUnloadedDrivers Cleaned:
    • API String ID: 2853312854-3011715350
    • Opcode ID: 38505e44c8f792e61f5d08c413b57af3f2208e4c6ba873b9fada4e97e8a7058d
    • Instruction ID: 7d226cffaa8fbe543b800a559334496f65e3542d2921236ab50b3422b8f2e7db
    • Opcode Fuzzy Hash: 38505e44c8f792e61f5d08c413b57af3f2208e4c6ba873b9fada4e97e8a7058d
    • Instruction Fuzzy Hash: 1AA1D326F18E5185FB90AB60D4403F9A3A8AF45FA8F806535DE4E17A85DF7CD249C320
    Function 00007FF712FA27A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 193memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Free$AllocControlDevice_invalid_parameter_noinfo_noreturn_stricmpmemset
    • String ID: PE
    • API String ID: 2498276250-4258593460
    • Opcode ID: 83d08ce342eba4fe71f38f57fdd648a2ffd480915f11e032d2e26724f4d6a8e3
    • Instruction ID: 8b19f4e58f8822ae1340002e34dd087aebe168cdd327169b25267a6ef5c356bc
    • Opcode Fuzzy Hash: 83d08ce342eba4fe71f38f57fdd648a2ffd480915f11e032d2e26724f4d6a8e3
    • Instruction Fuzzy Hash: 1C81C422B18E9186EAA0DB15E44036AA3A5FB89FE0F805235DE9E47BD4DF7CD485C710
    Function 00007FF712FAD960 Relevance: 13.6, APIs: 9, Instructions: 141nativememoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Free$InformationQuerySystem$Alloc_invalid_parameter_noinfo_noreturn_stricmp
    • String ID:
    • API String ID: 562193759-0
    • Opcode ID: a6827c8cb0e67d0c1547f0d54e66abefa56636be2953ed64555038e0627ab9f0
    • Instruction ID: b573e95e590d705cbe5f2ae07e6cdddcc1321d8bdbb22c14e67fee83c55b028a
    • Opcode Fuzzy Hash: a6827c8cb0e67d0c1547f0d54e66abefa56636be2953ed64555038e0627ab9f0
    • Instruction Fuzzy Hash: 6451F562B18D4242EB60AB25E40032AE369FF89FF4F945231DA5E436E8DF7CD589C710
    Function 00007FF712FAF350 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
    • String ID:
    • API String ID: 313767242-0
    • Opcode ID: f21188de37aeb5afc46f91044c5946636237b3ed6d310189bcc352f84bb1039d
    • Instruction ID: 9834ff29567877f9d8d60fe1bcbbbba493d628cd6fd319c01d9f50ed9368b679
    • Opcode Fuzzy Hash: f21188de37aeb5afc46f91044c5946636237b3ed6d310189bcc352f84bb1039d
    • Instruction Fuzzy Hash: C2311072609F8186EB60AF60E8503EEB368FB44754F844539DA4E47A94DF7DD64CC720
    Function 00007FF712FACA10 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 253COMMON
    Download Yara Rule
    APIs
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FACDB3
      • Part of subcall function 00007FF712FAE8F8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF712FA7B5F,?,?,?,?,?,?,?,?,?,00007FF712FA1347), ref: 00007FF712FAE912
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FACDAC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
    • String ID: gfffffff$gfffffff
    • API String ID: 1934640635-161084747
    • Opcode ID: 010f5592cb0d9fc498b0c71bf68df1184c5ce5cc269122a349b309fca8d1a99a
    • Instruction ID: 64e1d6d11ea0fb23216955c42aa5f813ab23d94555f2d1b5f04cc055765fcd4b
    • Opcode Fuzzy Hash: 010f5592cb0d9fc498b0c71bf68df1184c5ce5cc269122a349b309fca8d1a99a
    • Instruction Fuzzy Hash: 7FA1BDA2B05F8982DA40DF1AE4442ADB3A8F758F94F94A232DB8D47754DF78E5D9C300
    Function 00007FF712FAE6B8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
    Download Yara Rule
    APIs
    Strings
    • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF712FAE73B
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: DebugDebuggerErrorLastOutputPresentString
    • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
    • API String ID: 389471666-631824599
    • Opcode ID: bcd55b3d286835cf1a62951183ea9edb53974f4268d9f7ab121b0164fac76e01
    • Instruction ID: 1ef1629f9eb9036c6746f644673f0cf879321750a14c539526c2b72dc9711fc8
    • Opcode Fuzzy Hash: bcd55b3d286835cf1a62951183ea9edb53974f4268d9f7ab121b0164fac76e01
    • Instruction Fuzzy Hash: D2113D32A14F8693E744AB22D5453BA72A8FB44BA4F846135C65D82A50EFBCE57CC720
    Function 00007FF712FAF568 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
    • String ID:
    • API String ID: 2933794660-0
    • Opcode ID: 0f809ddf23e613b9863d94562b26c7da8db40f52779d4d40cce25ed7be15b6b9
    • Instruction ID: 1e08ae8d19e1bccb8dfaed620793deb7d26c36797f22a474a9a49c1f05efcec9
    • Opcode Fuzzy Hash: 0f809ddf23e613b9863d94562b26c7da8db40f52779d4d40cce25ed7be15b6b9
    • Instruction Fuzzy Hash: 53113026B14F018AEB00DF60E8542B973A8F719B68F841E31DE6D467A8DFB8D168C350
    Function 00007FF712FADFB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: FormatInfoLocaleMessage
    • String ID: !x-sys-default-locale
    • API String ID: 4235545615-2729719199
    • Opcode ID: 7b80c0e6822295a2a94d171d0d86f889474afe5b04160ea12453b2c0eed50d1b
    • Instruction ID: 885df49355a7c0363096651eb89d929c03ca3dc04c7759e00cef2050dfae0577
    • Opcode Fuzzy Hash: 7b80c0e6822295a2a94d171d0d86f889474afe5b04160ea12453b2c0eed50d1b
    • Instruction Fuzzy Hash: 5601B172B18BC582E7509B22F4407BAA7A5F788BE4F848135EA4D52B88CF7CD509CB10
    Function 00007FF712FAC3C0 Relevance: 3.3, APIs: 2, Instructions: 292COMMON
    Download Yara Rule
    APIs
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FAC7D6
      • Part of subcall function 00007FF712FAE8F8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF712FA7B5F,?,?,?,?,?,?,?,?,?,00007FF712FA1347), ref: 00007FF712FAE912
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAC7CF
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
    • String ID:
    • API String ID: 1934640635-0
    • Opcode ID: 88029f5556c40cb426cccf541cdd8e96023e4c304d04049f2f29d21126134cac
    • Instruction ID: b6671bf6fbbad7cdff5aaa5e384e39c756d824f2975720aefe944ecb3d36633e
    • Opcode Fuzzy Hash: 88029f5556c40cb426cccf541cdd8e96023e4c304d04049f2f29d21126134cac
    • Instruction Fuzzy Hash: 90B1BD73A04F8982DA40DF15E5446ADB3A8F799BE4F94A23AEB8C07745DF78D198C310
    Function 00007FF712FAF4FC Relevance: .0, Instructions: 2COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 9b18bb9ead59f1387bb93b2c7675af822d3acc4b7cae2a4d02b9e433fd9b8b99
    • Instruction ID: d8b4f3e88a65da92121889bf1ab3adc6259a5bf5d65d8e8b0c7ead9799da952b
    • Opcode Fuzzy Hash: 9b18bb9ead59f1387bb93b2c7675af822d3acc4b7cae2a4d02b9e433fd9b8b99
    • Instruction Fuzzy Hash: 24A0022190CC42D9E654AF10F854532A338FB53BA0FC05231C04D951A49FBDF50DC720
    Function 00007FF712FA3300 Relevance: 70.4, APIs: 20, Strings: 20, Instructions: 365COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 528 7ff712fa3300-7ff712fa338a call 7ff712fa3b10 * 2 533 7ff712fa3390-7ff712fa33c3 call 7ff712fa3b10 528->533 534 7ff712fa3418 528->534 542 7ff712fa33c5 533->542 543 7ff712fa33e8-7ff712fa3416 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 533->543 535 7ff712fa341c-7ff712fa342d 534->535 537 7ff712fa342f-7ff712fa3436 535->537 538 7ff712fa3438-7ff712fa34db call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa2110 535->538 540 7ff712fa33cc-7ff712fa33e3 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 537->540 556 7ff712fa34e2-7ff712fa34ea 538->556 557 7ff712fa34dd-7ff712fa34e0 538->557 551 7ff712fa395b-7ff712fa3983 call 7ff712fae7b0 540->551 542->540 543->535 558 7ff712fa34ed-7ff712fa3510 call 7ff712fa2110 556->558 557->558 561 7ff712fa3512-7ff712fa3515 558->561 562 7ff712fa3517-7ff712fa351f 558->562 563 7ff712fa3522-7ff712fa3536 call 7ff712fa2e90 561->563 562->563 566 7ff712fa3544-7ff712fa3589 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa12e0 call 7ff712fa3120 563->566 567 7ff712fa3538 563->567 574 7ff712fa3597-7ff712fa35af call 7ff712fa2110 566->574 575 7ff712fa358b-7ff712fa3592 566->575 567->566 580 7ff712fa35b1-7ff712fa35b8 574->580 581 7ff712fa35bd-7ff712fa35db call 7ff712fa2110 574->581 576 7ff712fa38ec 575->576 579 7ff712fa38f3-7ff712fa390b call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 576->579 586 7ff712fa390e call 7ff712fa2fe0 579->586 580->576 587 7ff712fa35e9-7ff712fa3628 call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 581->587 588 7ff712fa35dd-7ff712fa35e4 581->588 589 7ff712fa3913 586->589 595 7ff712fa38e5 587->595 596 7ff712fa362e-7ff712fa3684 DeviceIoControl 587->596 588->579 591 7ff712fa3915-7ff712fa391d 589->591 593 7ff712fa391f-7ff712fa3935 591->593 594 7ff712fa3958 591->594 597 7ff712fa3953 call 7ff712fae7d0 593->597 598 7ff712fa3937-7ff712fa394a 593->598 594->551 595->576 596->595 599 7ff712fa368a-7ff712fa3692 596->599 597->594 598->597 600 7ff712fa394c-7ff712fa3952 _invalid_parameter_noinfo_noreturn 598->600 602 7ff712fa3698-7ff712fa36ee DeviceIoControl 599->602 603 7ff712fa38dc-7ff712fa38e3 599->603 600->597 602->603 604 7ff712fa36f4-7ff712fa36f7 602->604 603->576 605 7ff712fa37fe-7ff712fa3805 604->605 606 7ff712fa36fd-7ff712fa3717 604->606 605->576 607 7ff712fa37d1-7ff712fa37d9 606->607 608 7ff712fa371d-7ff712fa3730 call 7ff712fae880 606->608 609 7ff712fa380a-7ff712fa3816 607->609 610 7ff712fa37db-7ff712fa37f8 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 607->610 608->607 616 7ff712fa3736-7ff712fa3767 call 7ff712fa79c0 608->616 613 7ff712fa3819 call 7ff712fa6f50 609->613 610->605 617 7ff712fa381e-7ff712fa3820 613->617 622 7ff712fa376a call 7ff712fa27a0 616->622 617->605 619 7ff712fa3822-7ff712fa3826 617->619 619->605 621 7ff712fa3828-7ff712fa384a call 7ff712fa2110 619->621 628 7ff712fa38aa-7ff712fa38ad 621->628 629 7ff712fa384c-7ff712fa3854 621->629 624 7ff712fa376f-7ff712fa377e 622->624 626 7ff712fa3780-7ff712fa3791 624->626 627 7ff712fa37b4-7ff712fa37cc call 7ff712fae814 624->627 630 7ff712fa37af call 7ff712fae7d0 626->630 631 7ff712fa3793-7ff712fa37a6 626->631 627->607 634 7ff712fa38b0 call 7ff712fa2fe0 628->634 629->628 632 7ff712fa3856-7ff712fa38a4 DeviceIoControl 629->632 630->627 631->630 635 7ff712fa37a8-7ff712fa37ae _invalid_parameter_noinfo_noreturn 631->635 632->628 637 7ff712fa38b5-7ff712fa38da call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 634->637 635->630 637->591
    APIs
      • Part of subcall function 00007FF712FA3B10: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3B85
      • Part of subcall function 00007FF712FA3B10: memcmp.VCRUNTIME140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3C10
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA33DB
      • Part of subcall function 00007FF712FA3B10: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3C82
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA33FE
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF712FA344E
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF712FA345E
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA346E
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF712FA3491
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF712FA34A1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA34B1
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA355A
      • Part of subcall function 00007FF712FA1800: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA14AE
      • Part of subcall function 00007FF712FA3120: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA3255
      • Part of subcall function 00007FF712FA3120: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA32A7
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA3902
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA394C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@_$V01@@$_invalid_parameter_noinfo_noreturn$?good@ios_base@std@@D@std@@@std@@U?$char_traits@V01@_V21@@Vios_base@1@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@V12@memcmp
    • String ID: RtlDeleteElementGenericTableAvl$[!] Failed to find RtlDeleteElementGenericTableAvl$[+] Found Table Entry = 0x$[+] PiDDBCacheTable Cleaned$[+] PiDDBCacheTable Ptr 0x$[+] PiDDBLock Locked$[+] PiDDBLock Ptr 0x$[+] PiDDBLock found with second pattern$[-] Can't delete from PiDDBCacheTable$[-] Can't get next entry$[-] Can't get prev entry$[-] Can't lock PiDDBCacheTable$[-] Can't set next entry$[-] Can't set prev entry$[-] Not found in cache$[-] Warning PiDDBCacheTable not found$[-] Warning PiDDBLock not found$xxx????xxxxx????xxx????x????x$xxxxxx$xxxxxx????xxxxx????xxx????xxxxx????x????xx?x
    • API String ID: 1542962237-602910616
    • Opcode ID: de307530e1b32bcf96bd40a67294a47ad79291bfcd60a9b686066fc2fc3c7b59
    • Instruction ID: c94858cc27f0737c82fa4d4662a9128da87332755a3836041f5f3d5baceb0242
    • Opcode Fuzzy Hash: de307530e1b32bcf96bd40a67294a47ad79291bfcd60a9b686066fc2fc3c7b59
    • Instruction Fuzzy Hash: EE023965F18F4295FB40EB65E8506A9A3A9FB44BA4FC06535D90E17B64DFBCE20CC320
    Function 00007FF712FAAB80 Relevance: 58.1, APIs: 19, Strings: 14, Instructions: 314memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 732 7ff712faab80-7ff712faabcd 733 7ff712fab041 732->733 734 7ff712faabd3-7ff712faabe0 732->734 735 7ff712fab048-7ff712fab05e call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 733->735 734->733 736 7ff712faabe6-7ff712faabef 734->736 742 7ff712fab064 735->742 738 7ff712faabf1-7ff712faabf8 736->738 739 7ff712faabfd-7ff712faac1a VirtualAlloc 736->739 738->735 741 7ff712faac20-7ff712faac3e 739->741 739->742 744 7ff712faac40-7ff712faac53 call 7ff712faa6e0 741->744 745 7ff712faac58-7ff712faac5a 741->745 743 7ff712fab066-7ff712fab08c call 7ff712fae7b0 742->743 755 7ff712faad84-7ff712faad8f 744->755 746 7ff712faac60-7ff712faac7c 745->746 747 7ff712faad57-7ff712faad62 745->747 751 7ff712faac82-7ff712faac95 call 7ff712fae880 746->751 752 7ff712faad2a-7ff712faad32 746->752 753 7ff712faaf71 747->753 767 7ff712faad26 751->767 768 7ff712faac9b-7ff712faace3 call 7ff712fa79c0 call 7ff712fa27a0 751->768 758 7ff712faad34-7ff712faad51 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 752->758 759 7ff712faad67-7ff712faad7e call 7ff712fa6680 752->759 757 7ff712faaf78-7ff712faafaa call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z VirtualFree call 7ff712fa2660 753->757 764 7ff712faad91-7ff712faad98 755->764 765 7ff712faad9d-7ff712faade9 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z memmove 755->765 757->742 758->747 759->747 775 7ff712faad80 759->775 764->753 776 7ff712faae1f-7ff712faaeaf call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fabe10 call 7ff712fab090 call 7ff712fabf60 call 7ff712fab190 765->776 777 7ff712faadeb-7ff712faadef 765->777 767->752 789 7ff712faace5-7ff712faacf6 768->789 790 7ff712faad1a-7ff712faad21 call 7ff712fae814 768->790 775->755 806 7ff712faaeb1-7ff712faaeb8 776->806 807 7ff712faaebd-7ff712faaedc call 7ff712fa2110 776->807 780 7ff712faadf0-7ff712faadf7 777->780 783 7ff712faadf9-7ff712faae08 memmove 780->783 784 7ff712faae0d-7ff712faae19 780->784 783->784 784->780 787 7ff712faae1b 784->787 787->776 793 7ff712faad14-7ff712faad19 call 7ff712fae7d0 789->793 794 7ff712faacf8-7ff712faad0b 789->794 790->767 793->790 794->793 796 7ff712faad0d-7ff712faad13 _invalid_parameter_noinfo_noreturn 794->796 796->793 806->753 810 7ff712faaeea-7ff712faaf33 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa92f0 807->810 811 7ff712faaede-7ff712faaee5 807->811 816 7ff712faaf35-7ff712faaf3c 810->816 817 7ff712faaf3e-7ff712faaf68 call 7ff712fab550 810->817 811->757 816->753 820 7ff712faafaf-7ff712faafb9 817->820 821 7ff712faaf6a 817->821 822 7ff712faafbd-7ff712faafff call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 820->822 823 7ff712faafbb 820->823 821->753 826 7ff712fab001-7ff712fab00b 822->826 827 7ff712fab02b-7ff712fab03f VirtualFree 822->827 823->822 828 7ff712fab026 call 7ff712fa2660 826->828 829 7ff712fab00d-7ff712fab023 call 7ff712fa2400 call 7ff712fa2530 826->829 827->743 828->827 829->828
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@VirtualW@std@@@std@@$AllocFree
    • String ID: bytes of PE Header$ExAllocatePoolWithTag$[!] Failed to find ExAllocatePool$[+] DriverEntry returned 0x$[+] Image base has been allocated at 0x$[+] Skipped 0x$[-] Callback returns false, failed!$[-] Failed to allocate remote image in kernel$[-] Failed to call driver entry$[-] Failed to resolve imports$[-] Failed to write local image to remote image$[-] Image is not 64 bit$[-] Invalid format of PE image$[<] Calling DriverEntry 0x
    • API String ID: 284350539-3204775764
    • Opcode ID: 8309aa031f3fe7d1f52456a86aea006dcbd6712e816aa191e5cc85707655c4ef
    • Instruction ID: c2ad7a619fdcb492df9e687420e0385da8144d8f9056570ceac62f615b9ad963
    • Opcode Fuzzy Hash: 8309aa031f3fe7d1f52456a86aea006dcbd6712e816aa191e5cc85707655c4ef
    • Instruction Fuzzy Hash: 55E16B65F18E0286FB50EB65E8402B9A369BB44FA4FC05532DE0D47795EEBCE64CC360
    Function 00007FF712FACF50 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 263registrylibraryloaderCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 835 7ff712facf50-7ff712facfa0 call 7ff712fa12e0 838 7ff712facfa6-7ff712facfe6 call 7ff712fa7e60 835->838 839 7ff712fad388-7ff712fad38d call 7ff712fa11d0 835->839 844 7ff712fad38e-7ff712fad393 call 7ff712fa11d0 838->844 845 7ff712facfec-7ff712facff1 838->845 839->844 847 7ff712facff6-7ff712fad03b call 7ff712fa7e60 RegCreateKeyW 845->847 848 7ff712facff3 845->848 852 7ff712fad046-7ff712fad081 RegSetKeyValueW 847->852 853 7ff712fad03d-7ff712fad044 847->853 848->847 855 7ff712fad083-7ff712fad089 RegCloseKey 852->855 856 7ff712fad0f8-7ff712fad127 RegSetKeyValueW 852->856 854 7ff712fad090-7ff712fad0a6 call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 853->854 861 7ff712fad0ac 854->861 855->854 857 7ff712fad129-7ff712fad136 RegCloseKey 856->857 858 7ff712fad13b-7ff712fad154 RegCloseKey GetModuleHandleA 856->858 857->854 860 7ff712fad15a-7ff712fad191 GetProcAddress * 2 858->860 858->861 869 7ff712fad19f-7ff712fad1aa 860->869 870 7ff712fad193-7ff712fad19a 860->870 863 7ff712fad0ae-7ff712fad0b6 861->863 864 7ff712fad2b1-7ff712fad2cb 863->864 865 7ff712fad0bc-7ff712fad0d2 863->865 871 7ff712fad306-7ff712fad320 864->871 872 7ff712fad2cd-7ff712fad2e3 864->872 867 7ff712fad0d8-7ff712fad0eb 865->867 868 7ff712fad2ac call 7ff712fae7d0 865->868 867->868 875 7ff712fad0f1-7ff712fad0f7 _invalid_parameter_noinfo_noreturn 867->875 868->864 878 7ff712fad382-7ff712fad387 call 7ff712fa11d0 869->878 879 7ff712fad1b0-7ff712fad246 call 7ff712fa7e60 RtlInitUnicodeString call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 869->879 870->854 876 7ff712fad322-7ff712fad338 871->876 877 7ff712fad35b-7ff712fad381 call 7ff712fae7b0 871->877 873 7ff712fad301 call 7ff712fae7d0 872->873 874 7ff712fad2e5-7ff712fad2f8 872->874 873->871 874->873 881 7ff712fad2fa-7ff712fad300 _invalid_parameter_noinfo_noreturn 874->881 875->856 883 7ff712fad356 call 7ff712fae7d0 876->883 884 7ff712fad33a-7ff712fad34d 876->884 878->839 896 7ff712fad248-7ff712fad24a 879->896 897 7ff712fad24c-7ff712fad24f 879->897 881->873 883->877 884->883 888 7ff712fad34f-7ff712fad355 _invalid_parameter_noinfo_noreturn 884->888 888->883 898 7ff712fad252-7ff712fad25a 896->898 897->898 899 7ff712fad295-7ff712fad2a7 898->899 900 7ff712fad25c-7ff712fad272 898->900 899->863 901 7ff712fad290 call 7ff712fae7d0 900->901 902 7ff712fad274-7ff712fad287 900->902 901->899 902->901 903 7ff712fad289-7ff712fad28f _invalid_parameter_noinfo_noreturn 902->903 903->901
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$_invalid_parameter_noinfo_noreturn$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$Close$AddressProcV01@@Valuememmove$CreateHandleInitModuleStringUnicodeV21@@Vios_base@1@Xlength_error@std@@
    • String ID: 4$Fatal error: failed to acquire SE_LOAD_DRIVER_PRIVILEGE. Make sure you are running as administrator.$ImagePath$NtLoadDriver$RtlAdjustPrivilege$SYSTEM\CurrentControlSet\Services\$Type$[+] NtLoadDriver Status 0x$[-] Can't create 'ImagePath' registry value$[-] Can't create 'Type' registry value$[-] Can't create service key$\??\$\Registry\Machine\System\CurrentControlSet\Services\$ntdll.dll
    • API String ID: 3141946345-3793529226
    • Opcode ID: 7dfcfe9bd8284bdd2360300c4de180c35d07c8d174683e2a2691aedab27e15b4
    • Instruction ID: f920fe85d5aa37236cae95b6f5af44f84c8c595f11c02c2029826853f663c645
    • Opcode Fuzzy Hash: 7dfcfe9bd8284bdd2360300c4de180c35d07c8d174683e2a2691aedab27e15b4
    • Instruction Fuzzy Hash: 4AC18121B18F4686FB40EB65E4443ADA369FB44BB8F805231DA5D53A98DFBCD24DC360
    Function 00007FF712FAA6E0 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 270COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 905 7ff712faa6e0-7ff712faa732 906 7ff712faa7da-7ff712faa7e2 905->906 907 7ff712faa738-7ff712faa74b call 7ff712fae880 905->907 908 7ff712faa854-7ff712faa881 906->908 909 7ff712faa7e4-7ff712faa801 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 906->909 907->906 916 7ff712faa751-7ff712faa780 call 7ff712fa79c0 907->916 911 7ff712faa884 call 7ff712fa5b30 908->911 918 7ff712faa807 909->918 914 7ff712faa889-7ff712faa88b 911->914 917 7ff712faa891-7ff712faa898 914->917 914->918 925 7ff712faa783 call 7ff712fa27a0 916->925 917->918 920 7ff712faa89e-7ff712faa8b9 call 7ff712fa2110 917->920 921 7ff712faa80e-7ff712faa824 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 918->921 929 7ff712faa8c7-7ff712faa8cd 920->929 930 7ff712faa8bb-7ff712faa8c2 920->930 931 7ff712faa82a 921->931 928 7ff712faa788-7ff712faa797 925->928 932 7ff712faa799-7ff712faa7aa 928->932 933 7ff712faa7ce-7ff712faa7d5 call 7ff712fae814 928->933 935 7ff712faa8cf-7ff712faa900 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa2530 929->935 936 7ff712faa90d-7ff712faa916 929->936 930->921 937 7ff712faa82c-7ff712faa853 call 7ff712fae7b0 931->937 938 7ff712faa7c8-7ff712faa7cd call 7ff712fae7d0 932->938 939 7ff712faa7ac-7ff712faa7bf 932->939 933->906 963 7ff712faa903 call 7ff712fa2660 935->963 941 7ff712faa9c0-7ff712faa9c8 936->941 942 7ff712faa91c-7ff712faa92f call 7ff712fae880 936->942 938->933 939->938 945 7ff712faa7c1-7ff712faa7c7 _invalid_parameter_noinfo_noreturn 939->945 948 7ff712faa9f9-7ff712faaa04 941->948 949 7ff712faa9ca-7ff712faa9e7 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 941->949 942->941 957 7ff712faa935-7ff712faa966 call 7ff712fa79c0 942->957 945->938 954 7ff712faaa07 call 7ff712fa5d80 948->954 960 7ff712faa9ed 949->960 958 7ff712faaa0c-7ff712faaa0e 954->958 967 7ff712faa969 call 7ff712fa27a0 957->967 958->960 962 7ff712faaa10-7ff712faaa17 958->962 960->948 962->960 966 7ff712faaa19-7ff712faaa22 962->966 964 7ff712faa908 963->964 964->931 968 7ff712faaa28-7ff712faaa3b call 7ff712fae880 966->968 969 7ff712faaacc-7ff712faaad4 966->969 970 7ff712faa96e-7ff712faa97d 967->970 968->969 979 7ff712faaa41-7ff712faaa72 call 7ff712fa79c0 968->979 972 7ff712faab2f-7ff712faab36 969->972 973 7ff712faaad6-7ff712faaaf3 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 969->973 975 7ff712faa97f-7ff712faa990 970->975 976 7ff712faa9b4-7ff712faa9bb call 7ff712fae814 970->976 974 7ff712faab39 call 7ff712fa5fd0 972->974 986 7ff712faaaf9-7ff712faab2a call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa2400 973->986 982 7ff712faab3e-7ff712faab40 974->982 983 7ff712faa992-7ff712faa9a5 975->983 984 7ff712faa9ae-7ff712faa9b3 call 7ff712fae7d0 975->984 976->941 994 7ff712faaa75 call 7ff712fa27a0 979->994 982->986 987 7ff712faab42-7ff712faab46 982->987 983->984 988 7ff712faa9a7-7ff712faa9ad _invalid_parameter_noinfo_noreturn 983->988 984->976 986->972 987->986 992 7ff712faab48-7ff712faab6e call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 987->992 988->984 1003 7ff712faab70 992->1003 1004 7ff712faab74-7ff712faab77 992->1004 997 7ff712faaa7a-7ff712faaa89 994->997 1000 7ff712faaac0-7ff712faaac7 call 7ff712fae814 997->1000 1001 7ff712faaa8b-7ff712faaa9c 997->1001 1000->969 1005 7ff712faaaba-7ff712faaabf call 7ff712fae7d0 1001->1005 1006 7ff712faaa9e-7ff712faaab1 1001->1006 1003->1004 1004->937 1005->1000 1006->1005 1008 7ff712faaab3-7ff712faaab9 _invalid_parameter_noinfo_noreturn 1006->1008 1008->1005
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAA7C1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAA801
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAA8EC
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAA9A7
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAA9E7
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAA824
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAAAB3
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAAAF3
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAAB16
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAAB65
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@W@std@@@std@@$_invalid_parameter_noinfo_noreturn$Virtual$AcquireAllocExclusiveFreeLockmemmovememset
    • String ID: MmAllocatePagesForMdl$MmMapLockedPagesSpecifyCache$MmProtectMdlSystemAddress$[!] Failed to find MmAlocatePagesForMdl$[!] Failed to find MmMapLockedPagesSpecifyCache$[!] Failed to find MmProtectMdlSystemAddress$[+] Allocated pages for mdl$[-] Can't allocate pages for mdl$[-] Can't change protection for mdl pages, cleaning up$[-] Can't read the _MDL : byteCount$[-] Can't set mdl pages cache, cleaning up.$[-] Couldn't allocate enough memory, cleaning up
    • API String ID: 3688386056-338763861
    • Opcode ID: b1a0454df157e8150791343c662980d3bc081e7deac5df9f32fa31baa35a9a36
    • Instruction ID: c5ca7eb4bd8afca023c8e981f3efbfc7246a7cbd8e0e2c44f26ac64fa513814e
    • Opcode Fuzzy Hash: b1a0454df157e8150791343c662980d3bc081e7deac5df9f32fa31baa35a9a36
    • Instruction Fuzzy Hash: 5AD1A125F18E0295FB40FB65E8546B9A369BF44BB4FC06632D91D026A5DFBCE24DC320
    Function 00007FF712FAD3A0 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 177registrylibraryloaderCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1011 7ff712fad3a0-7ff712fad3e1 GetModuleHandleA 1012 7ff712fad621-7ff712fad644 call 7ff712fae7b0 1011->1012 1013 7ff712fad3e7-7ff712fad3ff 1011->1013 1014 7ff712fad405-7ff712fad40d 1013->1014 1015 7ff712fad64b-7ff712fad650 call 7ff712fa11d0 1013->1015 1018 7ff712fad412-7ff712fad459 call 7ff712fa7e60 RtlInitUnicodeString 1014->1018 1019 7ff712fad40f 1014->1019 1024 7ff712fad45f-7ff712fad464 1018->1024 1025 7ff712fad645-7ff712fad64a call 7ff712fa11d0 1018->1025 1019->1018 1026 7ff712fad466 1024->1026 1027 7ff712fad469-7ff712fad4ae call 7ff712fa7e60 RegOpenKeyW 1024->1027 1025->1015 1026->1027 1032 7ff712fad4b0-7ff712fad4b6 1027->1032 1033 7ff712fad4bb-7ff712fad51d RegCloseKey GetProcAddress call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1027->1033 1034 7ff712fad586-7ff712fad58e 1032->1034 1049 7ff712fad561-7ff712fad57e RegDeleteTreeW 1033->1049 1050 7ff712fad51f-7ff712fad55f call 7ff712fa73f0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z RegDeleteTreeW 1033->1050 1036 7ff712fad590-7ff712fad5a6 1034->1036 1037 7ff712fad5c9-7ff712fad5e3 1034->1037 1041 7ff712fad5c4 call 7ff712fae7d0 1036->1041 1042 7ff712fad5a8-7ff712fad5bb 1036->1042 1038 7ff712fad5e5-7ff712fad5fb 1037->1038 1039 7ff712fad61e 1037->1039 1044 7ff712fad619 call 7ff712fae7d0 1038->1044 1045 7ff712fad5fd-7ff712fad610 1038->1045 1039->1012 1041->1037 1042->1041 1047 7ff712fad5bd-7ff712fad5c3 _invalid_parameter_noinfo_noreturn 1042->1047 1044->1039 1045->1044 1048 7ff712fad612-7ff712fad618 _invalid_parameter_noinfo_noreturn 1045->1048 1047->1041 1048->1044 1053 7ff712fad580-7ff712fad582 1049->1053 1054 7ff712fad584 1049->1054 1050->1034 1053->1034 1054->1034
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FAD3D5
    • RtlInitUnicodeString.NTDLL ref: 00007FF712FAD448
    • RegOpenKeyW.ADVAPI32 ref: 00007FF712FAD4A6
    • RegCloseKey.ADVAPI32 ref: 00007FF712FAD4BF
    • GetProcAddress.KERNEL32 ref: 00007FF712FAD4CF
      • Part of subcall function 00007FF712FA73F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7469
      • Part of subcall function 00007FF712FA73F0: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FA7489
      • Part of subcall function 00007FF712FA73F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7499
      • Part of subcall function 00007FF712FA73F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA7616
      • Part of subcall function 00007FF712FA73F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FA761D
      • Part of subcall function 00007FF712FA73F0: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FA762A
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF712FAD4FA
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z.MSVCP140 ref: 00007FF712FAD505
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAD515
    • RegDeleteTreeW.ADVAPI32 ref: 00007FF712FAD576
      • Part of subcall function 00007FF712FA73F0: ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF712FA74C4
      • Part of subcall function 00007FF712FA73F0: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA7536
      • Part of subcall function 00007FF712FA73F0: ?widen@?$ctype@_W@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF712FA757E
      • Part of subcall function 00007FF712FA73F0: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA758C
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAD53C
    • RegDeleteTreeW.ADVAPI32 ref: 00007FF712FAD557
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAD5BD
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAD612
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@_W@std@@@std@@$V01@$??6?$basic_ostream@_$?good@ios_base@std@@?sputc@?$basic_streambuf@_D@std@@@std@@DeleteTreeU?$char_traits@V01@@_invalid_parameter_noinfo_noreturn$?flush@?$basic_ostream@?getloc@ios_base@std@@?setstate@?$basic_ios@_?uncaught_exception@std@@?widen@?$ctype@_AddressCloseHandleInitModuleOpenOsfx@?$basic_ostream@ProcStringUnicodeV12@V21@@Vios_base@1@Vlocale@2@W@std@@
    • String ID: "$NtUnloadDriver$SYSTEM\CurrentControlSet\Services\$[+] NtUnloadDriver Status 0x$[-] Driver Unload Failed!!$\Registry\Machine\System\CurrentControlSet\Services\$ntdll.dll
    • API String ID: 2867398276-3977549460
    • Opcode ID: 3225a9fea96ae8bd8283cac72da16987d13c0697cff0ef66a9a9ae835bc1f091
    • Instruction ID: a7fecd947fd3e3e551048e656397583ababa29415ef32650eb78c4bc812505e7
    • Opcode Fuzzy Hash: 3225a9fea96ae8bd8283cac72da16987d13c0697cff0ef66a9a9ae835bc1f091
    • Instruction Fuzzy Hash: 8C717022B19E4685EB40AF65D8942BD6369FB44BB8F806631D91D077D8DFBCE14DC320
    Function 00007FF712FA1D20 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 195COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1174 7ff712fa1d20-7ff712fa1d7e call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1177 7ff712fa1d80-7ff712fa1d83 CloseHandle 1174->1177 1178 7ff712fa1d89-7ff712fa1da8 call 7ff712fa12e0 call 7ff712fad3a0 1174->1178 1177->1178 1183 7ff712fa1de4-7ff712fa1de6 1178->1183 1184 7ff712fa1daa-7ff712fa1dc1 1178->1184 1185 7ff712fa1def-7ff712fa1e6f call 7ff712fa1500 memset call 7ff712fa52c0 rand call 7ff712faeb84 1183->1185 1186 7ff712fa1de8-7ff712fa1dea 1183->1186 1187 7ff712fa1ddf call 7ff712fae7d0 1184->1187 1188 7ff712fa1dc3-7ff712fa1dd6 1184->1188 1200 7ff712fa1e71-7ff712fa1ea2 rand 1185->1200 1201 7ff712fa1ea4-7ff712fa1ed5 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ 1185->1201 1191 7ff712fa2020-7ff712fa2047 call 7ff712fae7b0 1186->1191 1187->1183 1188->1187 1189 7ff712fa1dd8-7ff712fa1dde _invalid_parameter_noinfo_noreturn 1188->1189 1189->1187 1200->1200 1200->1201 1202 7ff712fa1ed7 1201->1202 1203 7ff712fa1ede-7ff712fa1f00 call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z call 7ff712fa56e0 1201->1203 1202->1203 1208 7ff712fa1f20-7ff712fa1f7e call 7ff712fae7d0 _wremove 1203->1208 1209 7ff712fa1f02-7ff712fa1f1a ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z 1203->1209 1212 7ff712fa1f80-7ff712fa1f8b 1208->1212 1213 7ff712fa1fa7-7ff712fa1fab 1208->1213 1209->1208 1212->1213 1214 7ff712fa1f8d-7ff712fa1fa5 1212->1214 1215 7ff712fa1fb7-7ff712fa1fe1 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ 1213->1215 1216 7ff712fa1fad-7ff712fa1fb2 call 7ff712fa56e0 1213->1216 1214->1213 1218 7ff712fa1fe3-7ff712fa1ffa 1215->1218 1219 7ff712fa201d 1215->1219 1216->1215 1220 7ff712fa2018 call 7ff712fae7d0 1218->1220 1221 7ff712fa1ffc-7ff712fa200f 1218->1221 1219->1191 1220->1219 1221->1220 1222 7ff712fa2011-7ff712fa2017 _invalid_parameter_noinfo_noreturn 1221->1222 1222->1220
    APIs
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA1D70
    • CloseHandle.KERNEL32 ref: 00007FF712FA1D83
      • Part of subcall function 00007FF712FA1800: memset.VCRUNTIME140 ref: 00007FF712FA1545
      • Part of subcall function 00007FF712FA1800: GetTempPathW.KERNEL32 ref: 00007FF712FA1553
      • Part of subcall function 00007FF712FA1800: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA1673
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA1DD8
    • memset.VCRUNTIME140 ref: 00007FF712FA1E07
      • Part of subcall function 00007FF712FA52C0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FA52F3
      • Part of subcall function 00007FF712FA52C0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF712FA5312
      • Part of subcall function 00007FF712FA52C0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FA5344
      • Part of subcall function 00007FF712FA52C0: ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA535F
      • Part of subcall function 00007FF712FA52C0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA53A9
    • rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF712FA1E28
    • rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF712FA1E71
    • ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z.MSVCP140 ref: 00007FF712FA1EAF
    • ??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA1EBF
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA1EED
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA1F1A
    • _wremove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF712FA1F39
    • ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF712FA1FBC
    • ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF712FA1FC7
    • ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF712FA1FD1
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA2011
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$V01@$?setstate@?$basic_ios@__invalid_parameter_noinfo_noreturn$??6?$basic_ostream@_?good@ios_base@std@@V01@@V12@memsetrand$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@??1?$basic_streambuf@??7ios_base@std@@?flush@?$basic_ostream@?uncaught_exception@std@@?write@?$basic_ostream@CloseD@std@@@1@_HandleInit@?$basic_streambuf@Osfx@?$basic_ostream@PathTempV?$basic_streambuf@_wremove
    • String ID: [!] Error dumping shit inside the disk$[+] Vul driver data destroyed before unlink$[<] Unloading vulnerable driver
    • API String ID: 4129958369-4078119036
    • Opcode ID: 9f41a970af408f980f7f6be4154a77ba25afd5a99f3374468b30b03b8a73c675
    • Instruction ID: 85b0f7b1dff661b5100f7b5ad87eef688ad3f798e0bdf4185707bbe927280916
    • Opcode Fuzzy Hash: 9f41a970af408f980f7f6be4154a77ba25afd5a99f3374468b30b03b8a73c675
    • Instruction Fuzzy Hash: E691E621B18E4685EF40EB25E4542BEA369FB84BE4F805132DA5E43BA8DFBCD54DC710
    Function 00007FF712FA2660 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 197COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1224 7ff712fa2660-7ff712fa2673 1225 7ff712fa2770-7ff712fa277c 1224->1225 1226 7ff712fa2679-7ff712fa2693 1224->1226 1227 7ff712fa2743-7ff712fa274b 1226->1227 1228 7ff712fa2699-7ff712fa26ac call 7ff712fae880 1226->1228 1229 7ff712fa277d-7ff712fa68eb 1227->1229 1230 7ff712fa274d-7ff712fa276a call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1227->1230 1228->1227 1236 7ff712fa26b2-7ff712fa26ff call 7ff712fa79c0 call 7ff712fa27a0 1228->1236 1237 7ff712fa6922 1229->1237 1238 7ff712fa68ed-7ff712fa68fd GetModuleHandleA 1229->1238 1230->1225 1260 7ff712fa2701-7ff712fa2713 1236->1260 1261 7ff712fa2737-7ff712fa273e call 7ff712fae814 1236->1261 1239 7ff712fa6924-7ff712fa6940 call 7ff712fae7b0 1237->1239 1241 7ff712fa68ff 1238->1241 1242 7ff712fa6941-7ff712fa6957 GetProcAddress 1238->1242 1247 7ff712fa6906-7ff712fa691c call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1241->1247 1244 7ff712fa6962-7ff712fa698f 1242->1244 1245 7ff712fa6959-7ff712fa6960 1242->1245 1249 7ff712fa6a3f-7ff712fa6a49 1244->1249 1250 7ff712fa6995-7ff712fa69a8 call 7ff712fae880 1244->1250 1245->1247 1247->1237 1254 7ff712fa6a57-7ff712fa6a6c call 7ff712fa2110 1249->1254 1255 7ff712fa6a4b 1249->1255 1250->1249 1263 7ff712fa69ae-7ff712fa69fb call 7ff712fa79c0 call 7ff712fa27a0 1250->1263 1254->1237 1269 7ff712fa6a72-7ff712fa6a7b 1254->1269 1255->1254 1265 7ff712fa2731-7ff712fa2736 call 7ff712fae7d0 1260->1265 1266 7ff712fa2715-7ff712fa2728 1260->1266 1261->1227 1281 7ff712fa6a33-7ff712fa6a3a call 7ff712fae814 1263->1281 1282 7ff712fa69fd-7ff712fa6a0f 1263->1282 1265->1261 1266->1265 1270 7ff712fa272a-7ff712fa2730 _invalid_parameter_noinfo_noreturn 1266->1270 1273 7ff712fa6aaa-7ff712fa6ac0 call 7ff712fa21b0 1269->1273 1274 7ff712fa6a7d-7ff712fa6a86 1269->1274 1270->1265 1273->1237 1284 7ff712fa6ac6-7ff712fa6ae1 call 7ff712fa21b0 1273->1284 1274->1273 1275 7ff712fa6a88-7ff712fa6a91 1274->1275 1275->1273 1278 7ff712fa6a93-7ff712fa6a9c 1275->1278 1278->1273 1283 7ff712fa6a9e 1278->1283 1281->1249 1285 7ff712fa6a11-7ff712fa6a24 1282->1285 1286 7ff712fa6a2d-7ff712fa6a32 call 7ff712fae7d0 1282->1286 1283->1273 1284->1239 1285->1286 1288 7ff712fa6a26-7ff712fa6a2c _invalid_parameter_noinfo_noreturn 1285->1288 1286->1281 1288->1286
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA272A
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA276A
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FA68F4
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FA691C
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@VirtualW@std@@@std@@$AcquireAllocExclusiveFreeHandleLockModule_invalid_parameter_noinfo_noreturnmemmovememset
    • String ID: ExFreePool$NtAddAtom$[!] Failed to find ExAllocatePool$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 621326978-3600435281
    • Opcode ID: 35a6a69c4b559fda76afb814e073c28b3a3aade04ab1958f2d6355325d3efe4f
    • Instruction ID: 6ef738ceeff74fbdb7688a5a8532fd53b0888f5c7edaa654f0ff789cd2a7b51d
    • Opcode Fuzzy Hash: 35a6a69c4b559fda76afb814e073c28b3a3aade04ab1958f2d6355325d3efe4f
    • Instruction Fuzzy Hash: F891D165E1CE8685FE50FB11E840179A369FF89BB0FC06632D95D026A5DFACE58CC720
    Function 00007FF712FA2FE0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 197COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1294 7ff712fa2fe0-7ff712fa2ff3 1295 7ff712fa30f0-7ff712fa30fc 1294->1295 1296 7ff712fa2ff9-7ff712fa3013 1294->1296 1297 7ff712fa30c3-7ff712fa30cb 1296->1297 1298 7ff712fa3019-7ff712fa302c call 7ff712fae880 1296->1298 1299 7ff712fa30fd-7ff712fa6d4b 1297->1299 1300 7ff712fa30cd-7ff712fa30ea call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1297->1300 1298->1297 1306 7ff712fa3032-7ff712fa307f call 7ff712fa79c0 call 7ff712fa27a0 1298->1306 1307 7ff712fa6d82 1299->1307 1308 7ff712fa6d4d-7ff712fa6d5d GetModuleHandleA 1299->1308 1300->1295 1330 7ff712fa3081-7ff712fa3093 1306->1330 1331 7ff712fa30b7-7ff712fa30be call 7ff712fae814 1306->1331 1309 7ff712fa6d84-7ff712fa6da0 call 7ff712fae7b0 1307->1309 1311 7ff712fa6d5f 1308->1311 1312 7ff712fa6da1-7ff712fa6db7 GetProcAddress 1308->1312 1317 7ff712fa6d66-7ff712fa6d7c call 7ff712fa5910 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 1311->1317 1314 7ff712fa6dc2-7ff712fa6def 1312->1314 1315 7ff712fa6db9-7ff712fa6dc0 1312->1315 1319 7ff712fa6e9f-7ff712fa6ea9 1314->1319 1320 7ff712fa6df5-7ff712fa6e08 call 7ff712fae880 1314->1320 1315->1317 1317->1307 1323 7ff712fa6eb7-7ff712fa6ecc call 7ff712fa2110 1319->1323 1324 7ff712fa6eab 1319->1324 1320->1319 1333 7ff712fa6e0e-7ff712fa6e5b call 7ff712fa79c0 call 7ff712fa27a0 1320->1333 1323->1307 1339 7ff712fa6ed2-7ff712fa6edb 1323->1339 1324->1323 1335 7ff712fa30b1-7ff712fa30b6 call 7ff712fae7d0 1330->1335 1336 7ff712fa3095-7ff712fa30a8 1330->1336 1331->1297 1353 7ff712fa6e93-7ff712fa6e9a call 7ff712fae814 1333->1353 1354 7ff712fa6e5d-7ff712fa6e6f 1333->1354 1335->1331 1336->1335 1340 7ff712fa30aa-7ff712fa30b0 _invalid_parameter_noinfo_noreturn 1336->1340 1343 7ff712fa6f0a-7ff712fa6f20 call 7ff712fa21b0 1339->1343 1344 7ff712fa6edd-7ff712fa6ee6 1339->1344 1340->1335 1343->1307 1352 7ff712fa6f26-7ff712fa6f41 call 7ff712fa21b0 1343->1352 1344->1343 1347 7ff712fa6ee8-7ff712fa6ef1 1344->1347 1347->1343 1348 7ff712fa6ef3-7ff712fa6efc 1347->1348 1348->1343 1351 7ff712fa6efe 1348->1351 1351->1343 1352->1309 1353->1319 1355 7ff712fa6e71-7ff712fa6e84 1354->1355 1356 7ff712fa6e8d-7ff712fa6e92 call 7ff712fae7d0 1354->1356 1355->1356 1358 7ff712fa6e86-7ff712fa6e8c _invalid_parameter_noinfo_noreturn 1355->1358 1356->1353 1358->1356
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,-0000000A,00007FF712FA3913), ref: 00007FF712FA30AA
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,-0000000A,00007FF712FA3913), ref: 00007FF712FA30EA
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF712FA6D54
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF712FA6D7C
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@VirtualW@std@@@std@@$AcquireAllocExclusiveFreeHandleLockModule_invalid_parameter_noinfo_noreturnmemmovememset
    • String ID: ExReleaseResourceLite$NtAddAtom$[!] Failed to find ExReleaseResourceLite$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 621326978-1591343369
    • Opcode ID: 6b962467ddfba5b2656cd2cc873b8025575b50b9285f08327b7f6a6e9a5d0ace
    • Instruction ID: 825fb5e8e42e0367c7a4548bac75926c1c860ddc9d36888745da5199ee9fe1ba
    • Opcode Fuzzy Hash: 6b962467ddfba5b2656cd2cc873b8025575b50b9285f08327b7f6a6e9a5d0ace
    • Instruction Fuzzy Hash: AE919165E1CE8285EE50EB15E840179E369FF85BB4FC06232E95D026A5DFACE64CC720
    Function 00007FF712FA21B0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 130COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • DeviceIoControl.KERNEL32 ref: 00007FF712FA22D6
    • DeviceIoControl.KERNEL32 ref: 00007FF712FA2357
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA237A
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA238A
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA23D6
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA23E6
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@_$ControlDeviceV01@@$?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
    • String ID: [!] Failed to unmap IO space of physical address 0x$[-] Failed to map IO space of 0x$[-] Failed to translate virtual address 0x
    • API String ID: 2804743284-3202290428
    • Opcode ID: 162662bb59d799316a6c974aecfaca8f12dde749676955357c6bf86af9c4605b
    • Instruction ID: 631acef2130cd6441eb0b183a1835e3065e2c4809ac37d595141466c6458f9e5
    • Opcode Fuzzy Hash: 162662bb59d799316a6c974aecfaca8f12dde749676955357c6bf86af9c4605b
    • Instruction Fuzzy Hash: B2517E72B28F4185E7509F60E4403AEB3A9FB49B98F805535DA8D1BB58DF7CD219C320
    Function 00007FF712FA6680 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 132libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FA66BA
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA66E2
    • GetProcAddress.KERNEL32 ref: 00007FF712FA6712
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA67ED
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll$zErB
    • API String ID: 154489249-1150816730
    • Opcode ID: ccfdf9cf086bcf52ff93ed99d56e4614018c142d2d1fbe7b32a9d3428c9187f3
    • Instruction ID: 1421cbd07f0bea8813025e8b3c3569f7b08315954a73202c1c22cb53dc49ffbc
    • Opcode Fuzzy Hash: ccfdf9cf086bcf52ff93ed99d56e4614018c142d2d1fbe7b32a9d3428c9187f3
    • Instruction Fuzzy Hash: B651D065E1CE8284FE50EB15E840279E369FF85BB0FC06132E98C066A5DFACE54CC720
    Function 00007FF712FA5D80 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 138libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FA5DBE
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA5DE6
    • GetProcAddress.KERNEL32 ref: 00007FF712FA5E13
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA5EEE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 6c82ed449f77fedcfdb10a14f5d4163b338979a8116fa6d4a25449e195b1524a
    • Instruction ID: 70b14aebc361e2c293739d59f9bda785a20b8c840d95516aa7a74ffa70b2852e
    • Opcode Fuzzy Hash: 6c82ed449f77fedcfdb10a14f5d4163b338979a8116fa6d4a25449e195b1524a
    • Instruction Fuzzy Hash: 41517E65E1CE8281FA84EB11F844679A369FF95BB0FC06132E94D026A5DFBCE54CC720
    Function 00007FF712FA6F50 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 137libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,-0000000A,00000000,?,00007FF712FA381E), ref: 00007FF712FA6F98
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,-0000000A,00000000,?,00007FF712FA381E), ref: 00007FF712FA6FC0
    • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,-0000000A,00000000,?,00007FF712FA381E), ref: 00007FF712FA6FF3
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA70CE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 0598adac2f8279ac81a5400ede25dfba72f8451464c405e602607c560cc616fa
    • Instruction ID: f1e424d68fc0a021c8e3139117ee162f3c427119af50d30996a827b86eb45735
    • Opcode Fuzzy Hash: 0598adac2f8279ac81a5400ede25dfba72f8451464c405e602607c560cc616fa
    • Instruction Fuzzy Hash: 7351C265E1CE8284FE54EB11E840579E369EF85BB0FC06132E95D036A9DFACE54DC720
    Function 00007FF712FA71A0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 137libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FA71E8
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA7210
    • GetProcAddress.KERNEL32 ref: 00007FF712FA7243
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA731E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 86984a702af20f0b40f524f1c749dc087346bc73c86c58b57c2b0be3829f5aa6
    • Instruction ID: 663505d52e29e0045639960b78e006b83bae81cd8465b46df716f8ae5e17ef89
    • Opcode Fuzzy Hash: 86984a702af20f0b40f524f1c749dc087346bc73c86c58b57c2b0be3829f5aa6
    • Instruction Fuzzy Hash: 60518065A1CE8281FA54EB11E44057EE369FF85BB0FC06532EE4E026A5DEACE548C720
    Function 00007FF712FA6200 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 137libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2527), ref: 00007FF712FA6248
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2527), ref: 00007FF712FA6270
    • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2527), ref: 00007FF712FA62A3
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA637E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: a7aeee728203d2310d110607a9d1e2b9a6b044daf8f70859b1a0bd4e70a64d5d
    • Instruction ID: b9695330a5b5415162be71c6b88c1f5235b40c403f0ba0557e5b24e587018294
    • Opcode Fuzzy Hash: a7aeee728203d2310d110607a9d1e2b9a6b044daf8f70859b1a0bd4e70a64d5d
    • Instruction Fuzzy Hash: 7951A165E1CE8284FE50EB11E8401B9E369FF85BB0FC06532EA5D026A5DFACE54DC720
    Function 00007FF712FA5B30 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 136libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FA5B6B
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA5B93
    • GetProcAddress.KERNEL32 ref: 00007FF712FA5BBD
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA5C98
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 32dc34c0ae9ee0b6eba251c642774fc44b1622b33b1561fdd559461950f1189f
    • Instruction ID: ecbaed569806bdfe56129a4afa12542cd1a8e356300bd19ee96b9820f7e5e931
    • Opcode Fuzzy Hash: 32dc34c0ae9ee0b6eba251c642774fc44b1622b33b1561fdd559461950f1189f
    • Instruction Fuzzy Hash: 1351A0A5E1DE8280FA90EB11F8441B9A369EF85BB0FC06132D95D076A5DFACE54CC720
    Function 00007FF712FA6AF0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 134libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA2FC0), ref: 00007FF712FA6B2B
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA2FC0), ref: 00007FF712FA6B53
    • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA2FC0), ref: 00007FF712FA6B7D
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA6C58
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: c14c147c48265dd3acb890e12d03d46d933bbabdbd55ce446f90a33304c63688
    • Instruction ID: 1110230ed0a4e8a0298b75443701123aae90ef192eb894eb2cadf65131f6be15
    • Opcode Fuzzy Hash: c14c147c48265dd3acb890e12d03d46d933bbabdbd55ce446f90a33304c63688
    • Instruction Fuzzy Hash: D9519165E0CE8684FE50FB11A8401B9A369EF85BF0FC06132D95D036A5DFACE54CC720
    Function 00007FF712FAB550 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 134libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FAB587
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAB5AF
    • GetProcAddress.KERNEL32 ref: 00007FF712FAB5D9
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAB6B4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: ac434236ce5727dbf312b3eb01a30ece9946ece8440f4d78977fb1a9973d4127
    • Instruction ID: e06143b338953df95364dfef69cfc591bcf406fce544e2a925869297eaa3be0f
    • Opcode Fuzzy Hash: ac434236ce5727dbf312b3eb01a30ece9946ece8440f4d78977fb1a9973d4127
    • Instruction Fuzzy Hash: AF51D465E0CE8680FA54EB15E440179E369EFA5BB0FC06532E94D077A9EFACE54CC720
    Function 00007FF712FA5FD0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 134libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32 ref: 00007FF712FA600B
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA6033
    • GetProcAddress.KERNEL32 ref: 00007FF712FA605D
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA6138
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 889e8801427a32611402ce252f494299d1af2096b2670724ac2c8730fc5814fc
    • Instruction ID: 85ef1f38796d4dcb6fb2d9de7b16dbbddbe378349d75ad289fc5df5954d430f9
    • Opcode Fuzzy Hash: 889e8801427a32611402ce252f494299d1af2096b2670724ac2c8730fc5814fc
    • Instruction Fuzzy Hash: 54518065E1CE8284FE80EB11E841279A769EF85FB0FC06136E95D036A5DFACE54DC720
    Function 00007FF712FA6450 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 133libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2654), ref: 00007FF712FA648B
      • Part of subcall function 00007FF712FA21B0: DeviceIoControl.KERNEL32 ref: 00007FF712FA2233
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA2256
      • Part of subcall function 00007FF712FA21B0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2266
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2654), ref: 00007FF712FA64B3
    • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA2654), ref: 00007FF712FA64DD
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA65B8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$AddressControlDeviceHandleModuleProc_invalid_parameter_noinfo_noreturn
    • String ID: NtAddAtom$[-] FAILED!: The code was already hooked!! another instance of kdmapper running?!$[-] Failed to get export ntdll.NtAddAtom$[-] Failed to get export ntoskrnl.NtAddAtom$[-] Failed to load ntdll.dll$ntdll.dll
    • API String ID: 154489249-2622504768
    • Opcode ID: 19f761691804353067ecc0926fd1012f3672fb0e7a630a9f4463065463ea0e83
    • Instruction ID: 81cda1c39a3ffaac1327acdd8c93bb033cc720046d745a72104cb887f1207c32
    • Opcode Fuzzy Hash: 19f761691804353067ecc0926fd1012f3672fb0e7a630a9f4463065463ea0e83
    • Instruction Fuzzy Hash: 69518465E0CE8284FE90EB15E440579A369EF85BB0FC06532ED5D067A9DFACE54CC720
    Function 00007FF712FA73F0 Relevance: 16.7, APIs: 11, Instructions: 174COMMON
    Download Yara Rule
    APIs
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7469
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FA7489
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7499
    • ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF712FA74C4
      • Part of subcall function 00007FF712FA7770: ??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA779D
      • Part of subcall function 00007FF712FA7770: ??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA77B7
      • Part of subcall function 00007FF712FA7770: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA77E9
      • Part of subcall function 00007FF712FA7770: ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA7814
      • Part of subcall function 00007FF712FA7770: std::_Facet_Register.LIBCPMT ref: 00007FF712FA782D
      • Part of subcall function 00007FF712FA7770: ??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA784C
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA7536
    • ?widen@?$ctype@_W@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF712FA757E
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA758C
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA7616
    • ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FA761D
    • ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FA762A
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_D@std@@@std@@Lockit@std@@U?$char_traits@W@std@@$??0_??1_?flush@?$basic_ostream@?getloc@ios_base@std@@?setstate@?$basic_ios@_?uncaught_exception@std@@?widen@?$ctype@_Bid@locale@std@@Facet_Getcat@?$ctype@_Getgloballocale@locale@std@@Locimp@12@Osfx@?$basic_ostream@RegisterV12@V42@@Vfacet@locale@2@Vlocale@2@std::_
    • String ID:
    • API String ID: 2973256615-0
    • Opcode ID: 6e30b972e05837cadb7f8be51d6bda803ea3bc5b1344eee3df67cfc917f53fab
    • Instruction ID: b9604bee500374127a6dd7432b64e95ec409ddc8e362da1d78528ec863417329
    • Opcode Fuzzy Hash: 6e30b972e05837cadb7f8be51d6bda803ea3bc5b1344eee3df67cfc917f53fab
    • Instruction Fuzzy Hash: 79616A22A08E4185EB64AF1AE59063DE7A4FB84FA5F94D531CE4F437A0CE7DD44AC310
    Function 00007FF712FA91E0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 66COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF712FA8AC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA8BBC
    • _CxxThrowException.VCRUNTIME140 ref: 00007FF712FA9233
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF712FA9290
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF712FA929E
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF712FA9271
      • Part of subcall function 00007FF712FA5910: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A07
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA92C3
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@_W@std@@@std@@$V01@$??6?$basic_ostream@_$?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputc@?$basic_streambuf@_?uncaught_exception@std@@ExceptionOsfx@?$basic_ostream@ThrowV01@@V12@V21@@Vios_base@1@_invalid_parameter_noinfo_noreturn
    • String ID: by 0x$[!!] Crash$[!!] Crash at addr 0x$exists
    • API String ID: 1962189573-3783130642
    • Opcode ID: cb8aec755a4dff07834bb78939aba83dae9edfddd6cf4031469c8ad0a235181d
    • Instruction ID: 1fb41666efe0d2e4a0a550295a43e026d147dbdfb026b99481a77c6afdd47e62
    • Opcode Fuzzy Hash: cb8aec755a4dff07834bb78939aba83dae9edfddd6cf4031469c8ad0a235181d
    • Instruction Fuzzy Hash: E1219165E28D4681FF50FB15E8542B5A368FF88BA4FC06131D94E07665EFACE24CC720
    Function 00007FF712FAB780 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
    Download Yara Rule
    APIs
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FAB7F9
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FAB819
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FAB829
    • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF712FAB876
    • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF712FAB89D
    • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF712FAB8BE
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FAB904
    • ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FAB90B
    • ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FAB918
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@U?$char_traits@_V12@W@std@@@std@@
    • String ID:
    • API String ID: 2083409246-0
    • Opcode ID: 995241264b72de41830260dbbeacee41ba42a18de3e4f02d7f4f7901d45b0976
    • Instruction ID: 75ba818daf071ce54fc05d98af6cb0d224ef79497ec728ef195703974452cea6
    • Opcode Fuzzy Hash: 995241264b72de41830260dbbeacee41ba42a18de3e4f02d7f4f7901d45b0976
    • Instruction Fuzzy Hash: DC516032A08E4581EB60AF1DE490639E764FF94FA1F55D531CA4E437A0DF79D44AC310
    Function 00007FF712FA7FA0 Relevance: 13.6, APIs: 9, Instructions: 134COMMON
    Download Yara Rule
    APIs
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA800B
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FA802B
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA803B
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA8088
    • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF712FA80B6
    • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF712FA80D7
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA811E
    • ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FA8125
    • ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FA8132
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
    • String ID:
    • API String ID: 1647946921-0
    • Opcode ID: 2f02b737f9279430c0173249664ba262c41aeca312119fbd8b4292766f3a03f4
    • Instruction ID: c9a1e0f31692a5a531e8869f61e90161a3e300b16d1b5e733394afc055550c2f
    • Opcode Fuzzy Hash: 2f02b737f9279430c0173249664ba262c41aeca312119fbd8b4292766f3a03f4
    • Instruction Fuzzy Hash: E9511D32608E4181EB60AF1AE590639E7A4FF84FA5F55D532CE4E43B60CEBDD54AC310
    Function 00007FF712FABA70 Relevance: 13.6, APIs: 9, Instructions: 131COMMON
    Download Yara Rule
    APIs
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FABAD5
    • ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FABAF5
    • ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FABB05
    • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF712FABB4C
    • ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF712FABB79
    • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF712FABB9A
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FABBE0
    • ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FABBE7
    • ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FABBF4
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@U?$char_traits@_V12@W@std@@@std@@
    • String ID:
    • API String ID: 2083409246-0
    • Opcode ID: 2862dfad34ac5828d1a006ccca6c2ac85844cf3bb21fc956f02b1988b8e75b98
    • Instruction ID: 48cbbf16df4477771a1701ed6465a05d88f3a9ca1acbd191744c48cabec5d01f
    • Opcode Fuzzy Hash: 2862dfad34ac5828d1a006ccca6c2ac85844cf3bb21fc956f02b1988b8e75b98
    • Instruction Fuzzy Hash: 9C515E22A09E4582EB60AF1AE4D0239E7A4EF94FE1F55D931CE4E437A4DE7DD44AC310
    Function 00007FF712FAB190 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 262COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF712FAD960: NtQuerySystemInformation.NTDLL ref: 00007FF712FAD993
      • Part of subcall function 00007FF712FAD960: VirtualFree.KERNEL32 ref: 00007FF712FAD9B0
      • Part of subcall function 00007FF712FAD960: VirtualAlloc.KERNEL32 ref: 00007FF712FAD9C6
      • Part of subcall function 00007FF712FAD960: NtQuerySystemInformation.NTDLL ref: 00007FF712FAD9E1
      • Part of subcall function 00007FF712FAD960: VirtualFree.KERNEL32 ref: 00007FF712FADA02
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FAB2DE
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAB3F3
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAB47C
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAB504
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual_invalid_parameter_noinfo_noreturn$FreeInformationQuerySystemV01@$??6?$basic_ostream@_AllocU?$char_traits@_V01@@W@std@@@std@@
    • String ID: wasn't found$[-] Dependency $[-] Failed to resolve import
    • API String ID: 1004173435-3042260135
    • Opcode ID: 645e99253ffd2f566eefbc96e6a7edf7e8775c11949c8009a4399fe78bdfe6de
    • Instruction ID: 903785664e824102cd575509132cee2d9d082d5c2a1e7b73808cdcc3b9176bb8
    • Opcode Fuzzy Hash: 645e99253ffd2f566eefbc96e6a7edf7e8775c11949c8009a4399fe78bdfe6de
    • Instruction Fuzzy Hash: 3491D861B05F4A81EE48EF56E45427DA3A9EB59FD0F80A836CE4D4B755EEBCD088C310
    Function 00007FF712FA8BF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 194COMMON
    Download Yara Rule
    APIs
    • __std_fs_code_page.MSVCPRT ref: 00007FF712FA8C4F
      • Part of subcall function 00007FF712FAE050: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,00007FF712FA8C54), ref: 00007FF712FAE054
      • Part of subcall function 00007FF712FAE050: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF712FA8C54), ref: 00007FF712FAE063
    • memmove.VCRUNTIME140 ref: 00007FF712FA8D1F
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA8DFA
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA8E3F
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA8E8D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: _invalid_parameter_noinfo_noreturn$ApisFile___lc_codepage_func__std_fs_code_pagememmove
    • String ID: ", "$: "
    • API String ID: 1229626011-747220369
    • Opcode ID: 77aebda6c8ace7f27da960d44581003b861d7b784f5c4b33078a3c17ff0196f5
    • Instruction ID: 88a6e20a64dac81b237f5ccb8ee6d514553d5102e924f8a844edd4a168ea3592
    • Opcode Fuzzy Hash: 77aebda6c8ace7f27da960d44581003b861d7b784f5c4b33078a3c17ff0196f5
    • Instruction Fuzzy Hash: 7981B162B04F4589EB44EF65D4843ACA326FB44FA8F806531DE1E13B99DFB8D558C350
    Function 00007FF712FA3990 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 98COMMON
    Download Yara Rule
    APIs
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA39D3
      • Part of subcall function 00007FF712FA2110: DeviceIoControl.KERNEL32 ref: 00007FF712FA2178
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3A34
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3AC8
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@_V01@@$?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?uncaught_exception@std@@ControlDeviceOsfx@?$basic_ostream@V12@
    • String ID: [-] Can't find pattern$[-] Can't find pattern, Too big section$[-] No module address to find pattern$[-] Read failed in FindPatternAtKernel
    • API String ID: 3011380806-521562947
    • Opcode ID: 9681650a9704a53e467fc2b676a7d8eda154af6d3dcc580528ff5f037b4c977e
    • Instruction ID: dbaf95ab58f5866128dd051ec0131063300d81a5c3a2c39a1cc3dc4afa929b65
    • Opcode Fuzzy Hash: 9681650a9704a53e467fc2b676a7d8eda154af6d3dcc580528ff5f037b4c977e
    • Instruction Fuzzy Hash: 58419C69E18E5281FA90AB11A854279E369EF49FF0FC42132D95F07695DFECE60DC320
    Function 00007FF712FADBD0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON
    Download Yara Rule
    APIs
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADC13
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADC3B
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADCA5
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADCCE
    • ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADCEF
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADD38
    • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADD83
    • ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADDC3
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@$?sgetc@?$basic_streambuf@$?sbumpc@?$basic_streambuf@
    • String ID:
    • API String ID: 2679766405-0
    • Opcode ID: ae3bff6e265307a41a570617d580a1bc1f3e832f3c244a2d68e2611d1d70cf92
    • Instruction ID: 02f2f4580af5f223150e7f24c14cf68f03357f8a24b11ca8503478efd7721569
    • Opcode Fuzzy Hash: ae3bff6e265307a41a570617d580a1bc1f3e832f3c244a2d68e2611d1d70cf92
    • Instruction Fuzzy Hash: 3861F82190DE8242EEA56B21A500179E768AF16F78F986530DFAE073D1DFBCE45DD320
    Function 00007FF712FAD660 Relevance: 12.1, APIs: 8, Instructions: 135COMMON
    Download Yara Rule
    APIs
    • memset.VCRUNTIME140 ref: 00007FF712FAD6A1
    • ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FAD6C0
    • ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF712FAD6DF
    • ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FAD713
    • ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FAD732
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FAD77B
    • ??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FAD7B4
      • Part of subcall function 00007FF712FADBD0: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADC13
      • Part of subcall function 00007FF712FADBD0: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADC3B
      • Part of subcall function 00007FF712FADBD0: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADCA5
      • Part of subcall function 00007FF712FADBD0: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF712FADD38
      • Part of subcall function 00007FF712FA56E0: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF712FA5740
      • Part of subcall function 00007FF712FA56E0: ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA5762
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FAD85A
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@$D@std@@@std@@$?sgetc@?$basic_streambuf@$?setstate@?$basic_ios@_Init@?$basic_streambuf@U?$char_traits@_W@std@@@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??7ios_base@std@@D@std@@@1@_V?$basic_streambuf@fclosememset
    • String ID:
    • API String ID: 3683839571-0
    • Opcode ID: 25883d728def731ad64dee20e29615aa019122eee087f319b2970cee591e8202
    • Instruction ID: 34c7417998a0eaa68470dc537481a5972dcb1f5646191d5212e935bb5e0ffacd
    • Opcode Fuzzy Hash: 25883d728def731ad64dee20e29615aa019122eee087f319b2970cee591e8202
    • Instruction Fuzzy Hash: 77618232618B85CADB10DF64E4802AEB774FB85B58F444126EB8C43B68DFBDD508CB10
    Function 00007FF712FA7C40 Relevance: 10.7, APIs: 7, Instructions: 159COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
    • String ID:
    • API String ID: 2016347663-0
    • Opcode ID: 9f934668936d86b54b86d4dd7fc3ccd8f8fef71026727e6d955ff449e3898f8a
    • Instruction ID: 53ddd0a47ab1abda025e7bd6f29edd8b2c76012374265dac405a892f24976926
    • Opcode Fuzzy Hash: 9f934668936d86b54b86d4dd7fc3ccd8f8fef71026727e6d955ff449e3898f8a
    • Instruction Fuzzy Hash: 7251D032A08F8181EA54BF25D4446ACA368FB54FA8FA45635DF2E073D1CFB8E198C350
    Function 00007FF712FA3B10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 110COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF712FA2110: DeviceIoControl.KERNEL32 ref: 00007FF712FA2178
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3B85
      • Part of subcall function 00007FF712FA5910: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A07
    • memcmp.VCRUNTIME140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3C10
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(FFFFFFFF,00000000,?,?,?,00007FF712FA15D3), ref: 00007FF712FA598A
      • Part of subcall function 00007FF712FA5910: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59AA
      • Part of subcall function 00007FF712FA5910: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA59BA
      • Part of subcall function 00007FF712FA5910: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5A9D
      • Part of subcall function 00007FF712FA5910: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AA4
      • Part of subcall function 00007FF712FA5910: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,00007FF712FA15D3), ref: 00007FF712FA5AB1
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,00007FF712FA3350), ref: 00007FF712FA3C82
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@_V01@W@std@@@std@@$??6?$basic_ostream@_?good@ios_base@std@@D@std@@@std@@U?$char_traits@V01@@$?flush@?$basic_ostream@?setstate@?$basic_ios@_?sputc@?$basic_streambuf@_?uncaught_exception@std@@ControlDeviceOsfx@?$basic_ostream@V12@memcmp
    • String ID: PAGE$[-] Can't find section$[-] Can't read module headers
    • API String ID: 638855019-1129567509
    • Opcode ID: c1b9f6722e048ac76462a8418d5f70b9f9fa35a5b740861809e3c77073f68516
    • Instruction ID: 3e942aeccbcaeae406a1e2efdbf4f3b2c583bd57585acd06b8835915e9d27650
    • Opcode Fuzzy Hash: c1b9f6722e048ac76462a8418d5f70b9f9fa35a5b740861809e3c77073f68516
    • Instruction Fuzzy Hash: 5D417335A08EC681EA60AB15E4401BAE399FB45BA4F902231DE9E07798DFFCD589C710
    Function 00007FF712FA7660 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
    Download Yara Rule
    APIs
    • ??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA768D
    • ??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA76A7
    • ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA76D9
    • ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA7704
    • std::_Facet_Register.LIBCPMT ref: 00007FF712FA771D
    • ??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA773C
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FA7767
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
    • String ID:
    • API String ID: 762505753-0
    • Opcode ID: fc0c05cf245312811c55d37bca6684000efdcfe318ee16aa275d3c0e69135d5b
    • Instruction ID: 563b29c3095fb1a55e9515175cfb53992935f2f30e983db6c47c999f884245ca
    • Opcode Fuzzy Hash: fc0c05cf245312811c55d37bca6684000efdcfe318ee16aa275d3c0e69135d5b
    • Instruction Fuzzy Hash: B8318F26A08F4581EB54AF15E84016EB368FB88FE4F881631DB9E077A4CF7CE558CB10
    Function 00007FF712FA7770 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
    Download Yara Rule
    APIs
    • ??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA779D
    • ??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA77B7
    • ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA77E9
    • ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA7814
    • std::_Facet_Register.LIBCPMT ref: 00007FF712FA782D
    • ??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF712FA587A), ref: 00007FF712FA784C
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FA7877
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$ctype@_Getgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@W@std@@std::_
    • String ID:
    • API String ID: 3972169111-0
    • Opcode ID: 3efbe734a0d7aa127617d418fdae985bc1ea4853025692f7bca7142041a1f8b9
    • Instruction ID: 50791f184b134bec1f08c94de241fc996c3bc9495943453795bbf4e64bd2aad7
    • Opcode Fuzzy Hash: 3efbe734a0d7aa127617d418fdae985bc1ea4853025692f7bca7142041a1f8b9
    • Instruction Fuzzy Hash: 5D316E26A08F4581EB54AF15E44056AB368FB88FA4F881631DA9E077A4CFBCE598C710
    Function 00007FF712FA4C40 Relevance: 9.2, APIs: 6, Instructions: 178COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: fgetc
    • String ID:
    • API String ID: 2807381905-0
    • Opcode ID: 5c9360094abfdcaad5a1fbe469f4c87194c21e3cc4b8d4d3b104f360325181d3
    • Instruction ID: 911edbeb3801ec9dd7e115d1cb93b5cd7fb8aec12dc2a599ca35c3efcfbf20f5
    • Opcode Fuzzy Hash: 5c9360094abfdcaad5a1fbe469f4c87194c21e3cc4b8d4d3b104f360325181d3
    • Instruction Fuzzy Hash: A8819C32B04E4198EB40DF64C4803AD77B8FB48B68F941632DA1D53B98DF78D5A8C320
    Function 00007FF712FAA3A0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON
    Download Yara Rule
    APIs
    • memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FAA48F
    • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FAA49C
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FAA4D5
    • memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FAA4DF
    • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF712FAA4EC
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FAA520
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmovememset$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
    • String ID:
    • API String ID: 2171940698-0
    • Opcode ID: 76d32cd794f8d37f6432e671754ca973aea2a5c3a3a6e8336055bc2432d9ca23
    • Instruction ID: 4cff80e95b9c5f506f42f44da055a6f987eb926ec22926e2b58483b2e50efeea
    • Opcode Fuzzy Hash: 76d32cd794f8d37f6432e671754ca973aea2a5c3a3a6e8336055bc2432d9ca23
    • Instruction Fuzzy Hash: 4841F421B18E4181EA50EF26E24826EA3A9EB44FF0F845635EE6D077D5DEBCD05DC320
    Function 00007FF712FAA530 Relevance: 9.1, APIs: 6, Instructions: 112COMMON
    Download Yara Rule
    APIs
    • memmove.VCRUNTIME140(?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF712FA9F85), ref: 00007FF712FAA624
    • memmove.VCRUNTIME140(?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF712FA9F85), ref: 00007FF712FAA632
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF712FA9F85), ref: 00007FF712FAA66B
    • memmove.VCRUNTIME140(?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF712FA9F85), ref: 00007FF712FAA675
    • memmove.VCRUNTIME140(?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF712FA9F85), ref: 00007FF712FAA683
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FAA6B8
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
    • String ID:
    • API String ID: 2016347663-0
    • Opcode ID: 138ee53cf7a6f8e33c05b3e84bf3ed7a69d9c4d127627c5a14d9e7585bc29991
    • Instruction ID: 52c17ed534a32f202a1e220aed8e359101aa9aa15db1bd560b583614e294b0bc
    • Opcode Fuzzy Hash: 138ee53cf7a6f8e33c05b3e84bf3ed7a69d9c4d127627c5a14d9e7585bc29991
    • Instruction Fuzzy Hash: EC410262B19E4285EE60BB16950426AE3A9FB04FE0F881631DE5D0B7C5DEBCE04CC724
    Function 00007FF712FA57A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
    Download Yara Rule
    APIs
    • ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF712FA57DA
    • ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA57F7
    • _get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF712FA5820
    • ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF712FA586B
      • Part of subcall function 00007FF712FA7660: ??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA768D
      • Part of subcall function 00007FF712FA7660: ??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA76A7
      • Part of subcall function 00007FF712FA7660: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA76D9
      • Part of subcall function 00007FF712FA7660: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA7704
      • Part of subcall function 00007FF712FA7660: std::_Facet_Register.LIBCPMT ref: 00007FF712FA771D
      • Part of subcall function 00007FF712FA7660: ??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF712FA587A), ref: 00007FF712FA773C
    • ?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA5880
    • ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA5897
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: D@std@@@std@@U?$char_traits@$Init@?$basic_streambuf@Lockit@std@@$??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@Bid@locale@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
    • String ID:
    • API String ID: 3911317180-0
    • Opcode ID: c354ea2c32dc86adfe6d6ccd3333bf63ea57a083845b076d1c720a198f2f3d27
    • Instruction ID: 8869c08a7ebd518adc50912e8607dff6623d40422bb8b72d816723efa7a9f457
    • Opcode Fuzzy Hash: c354ea2c32dc86adfe6d6ccd3333bf63ea57a083845b076d1c720a198f2f3d27
    • Instruction Fuzzy Hash: D9315832A09F4182EB90AF25B84472AB3E8FB48F98F441135DA8E07B58EF7CD448C710
    Function 00007FF712FA52C0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
    Download Yara Rule
    APIs
    • ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FA52F3
    • ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF712FA5312
    • ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF712FA5344
    • ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA535F
      • Part of subcall function 00007FF712FA57A0: ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF712FA57DA
      • Part of subcall function 00007FF712FA57A0: ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF712FA57F7
      • Part of subcall function 00007FF712FA57A0: _get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF712FA5820
      • Part of subcall function 00007FF712FA57A0: ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF712FA586B
      • Part of subcall function 00007FF712FA57A0: ?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA5880
    • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA53A9
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_D@std@@@1@_Fiopen@std@@U?$char_traits@_U_iobuf@@V?$basic_streambuf@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointers
    • String ID:
    • API String ID: 3167182450-0
    • Opcode ID: 3e7188ed2be0308aff44c332e7ad335a206ca2894e76ea5de0786c4a5f0ef909
    • Instruction ID: aed4abcbb43f1cb04332a8a99bff17e11ee5da46d120f9fe5560c8c18b80bfa7
    • Opcode Fuzzy Hash: 3e7188ed2be0308aff44c332e7ad335a206ca2894e76ea5de0786c4a5f0ef909
    • Instruction Fuzzy Hash: 33211932608F4586EB109F29F85472AB7A8FB89F98F848135DA8D43724DF7DD109CB50
    Function 00007FF712FACDD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
    Download Yara Rule
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FACE79
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FACF29
      • Part of subcall function 00007FF712FAE8F8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF712FA7B5F,?,?,?,?,?,?,?,?,?,00007FF712FA1347), ref: 00007FF712FAE912
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
    • String ID: gfffffff$gfffffff
    • API String ID: 1934640635-161084747
    • Opcode ID: 125928987bac40873d51d87558d4c1396d3723bbe5d6c1ea923cbd2a1b7af872
    • Instruction ID: 805dc8bd5a9bf8d4e5d7dc2d705214d38c8c3743ad025905fcaf62a95ee4a15f
    • Opcode Fuzzy Hash: 125928987bac40873d51d87558d4c1396d3723bbe5d6c1ea923cbd2a1b7af872
    • Instruction Fuzzy Hash: A5510172605F4981EE94EF13F440269A3A9EB48FE0F989632DA8D87B94DF7CD095C311
    Function 00007FF712FA3120 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON
    Download Yara Rule
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA3255
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA32A7
      • Part of subcall function 00007FF712FA71A0: GetModuleHandleA.KERNEL32 ref: 00007FF712FA71E8
      • Part of subcall function 00007FF712FA71A0: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA7210
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@$??6?$basic_ostream@_U?$char_traits@_V01@@W@std@@@std@@$HandleModule_invalid_parameter_noinfo_noreturn
    • String ID: RtlLookupElementGenericTableAvl$[!] Failed to find RtlLookupElementGenericTableAvl
    • API String ID: 4059861771-1952825546
    • Opcode ID: bcd49be5a217e407e850f460350e7be60e9ac90b43849d76150decf3d1dc7fe4
    • Instruction ID: 3ad9c1837844eee97b7a637b279fae4dc21e3fb8ca3e1a8a31e4bf23c706293b
    • Opcode Fuzzy Hash: bcd49be5a217e407e850f460350e7be60e9ac90b43849d76150decf3d1dc7fe4
    • Instruction Fuzzy Hash: 27419525E18F8681EA40EB15E840779E364FBD4BB0F905235EA9D436A5DFBCE188C710
    Function 00007FF712FA2E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,-0000000A,00007FF712FA352D), ref: 00007FF712FA2F9A
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,-0000000A,00007FF712FA352D), ref: 00007FF712FA2F5A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@Virtual$??6?$basic_ostream@_AcquireAllocExclusiveFreeLockU?$char_traits@_V01@@W@std@@@std@@_invalid_parameter_noinfo_noreturnmemmovememset
    • String ID: ExAcquireResourceExclusiveLite$[!] Failed to find ExAcquireResourceExclusiveLite
    • API String ID: 553075718-2131800721
    • Opcode ID: baee237ac382df74e71630cb824e1fa9c00e14fbca817ab0610956009f8a0346
    • Instruction ID: 559bdddbe9e2988e2250d6663bbba2c5111748e5116cd36924d3a4410a8032da
    • Opcode Fuzzy Hash: baee237ac382df74e71630cb824e1fa9c00e14fbca817ab0610956009f8a0346
    • Instruction Fuzzy Hash: 01318565F28E4641FE80EB14E4403B9A359EF95BF0FD06231E95E426E5DFACE588C720
    Function 00007FF712FA2400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
    Download Yara Rule
    APIs
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2502
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA24C2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@Virtual$??6?$basic_ostream@_AcquireAllocExclusiveFreeLockU?$char_traits@_V01@@W@std@@@std@@_invalid_parameter_noinfo_noreturnmemmovememset
    • String ID: MmUnmapLockedPages$[!] Failed to find MmUnmapLockedPages
    • API String ID: 553075718-2848997145
    • Opcode ID: 2bbbd5cf02c9539b27defda79233b67272ac196bb32ad00827a22407c3b2ad44
    • Instruction ID: 3861195364de80ecf2648c38620fd40ac2d6d648d875139a50a35123bdb5f30d
    • Opcode Fuzzy Hash: 2bbbd5cf02c9539b27defda79233b67272ac196bb32ad00827a22407c3b2ad44
    • Instruction Fuzzy Hash: 78319465F28E4641FA40FB18E8406B5A325AF95BF0FD06632E91D426E5DFACE5C9C320
    Function 00007FF712FA2530 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA2631
      • Part of subcall function 00007FF712FAE880: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF712FAE890
      • Part of subcall function 00007FF712FA79C0: memmove.VCRUNTIME140(00000000,?,?,?,00007FF712FA1347), ref: 00007FF712FA79F8
      • Part of subcall function 00007FF712FA27A0: memset.VCRUNTIME140 ref: 00007FF712FA27FE
      • Part of subcall function 00007FF712FA27A0: VirtualAlloc.KERNEL32 ref: 00007FF712FA28B1
      • Part of subcall function 00007FF712FA27A0: VirtualFree.KERNEL32 ref: 00007FF712FA28E8
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA25F1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: V01@Virtual$??6?$basic_ostream@_AcquireAllocExclusiveFreeLockU?$char_traits@_V01@@W@std@@@std@@_invalid_parameter_noinfo_noreturnmemmovememset
    • String ID: MmFreePagesFromMdl$[!] Failed to find MmFreePagesFromMdl
    • API String ID: 553075718-1029121595
    • Opcode ID: 474e974e00c07895c1f24c7bfaa3daabff343b95b0cbf13d464a2a10fa22dde9
    • Instruction ID: 95279603b133e0cbb5ca2f2c192765738fb92340532112229085ed69b0857758
    • Opcode Fuzzy Hash: 474e974e00c07895c1f24c7bfaa3daabff343b95b0cbf13d464a2a10fa22dde9
    • Instruction Fuzzy Hash: F431C865F18E4641EE40EB15E850275A365FF88BF0FC06731D96D027A5DFACE588C710
    Function 00007FF712FA92F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12processCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF712FA73F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7469
      • Part of subcall function 00007FF712FA73F0: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF712FA7489
      • Part of subcall function 00007FF712FA73F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF712FA7499
      • Part of subcall function 00007FF712FA73F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF712FA7616
      • Part of subcall function 00007FF712FA73F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF712FA761D
      • Part of subcall function 00007FF712FA73F0: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF712FA762A
    • ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF712FA9311
    • system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA931E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@U?$char_traits@_V01@W@std@@@std@@$??6?$basic_ostream@_?flush@?$basic_ostream@?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@V01@@V12@system
    • String ID: [+] Callback example called$pause
    • API String ID: 1016348259-1534954768
    • Opcode ID: 33508f0c83e1a5f07c8441ff7fb8a9ca715392c64914d1990f8bc9417df90bb5
    • Instruction ID: e554d5530544f7bfc037c2e11fff63d9a6a7edb1c925d2ad5a4db68f4e5ba4fd
    • Opcode Fuzzy Hash: 33508f0c83e1a5f07c8441ff7fb8a9ca715392c64914d1990f8bc9417df90bb5
    • Instruction Fuzzy Hash: 51E0EC68E08D0790EA14BB01E8850759329BF58BA1FC01031C80F06230EEACE64EC730
    Function 00007FF712FA8ED0 Relevance: 6.2, APIs: 4, Instructions: 208COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
    • String ID:
    • API String ID: 2138705365-0
    • Opcode ID: 869f0602a0a687fa389a594b351a61fe7d91b5b5e84e8b672e990f446cde2dae
    • Instruction ID: 862a95f9bbcb36be52b110b1a647d0f84bf95564118a5e25d4f3ba4ba421917f
    • Opcode Fuzzy Hash: 869f0602a0a687fa389a594b351a61fe7d91b5b5e84e8b672e990f446cde2dae
    • Instruction Fuzzy Hash: 35818D72604E8581EF04AF29D48836DA32AFB44FD8F90A031D74D07A69EFB9D9D8C350
    Function 00007FF712FABF60 Relevance: 6.2, APIs: 4, Instructions: 204COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: _invalid_parameter_noinfo_noreturn$memmove
    • String ID:
    • API String ID: 15630516-0
    • Opcode ID: e1937754f0f8dc652a4ec082e13e796315af966f323772c4cdfdb1cef055ca1a
    • Instruction ID: 9032ed640d0a7c3b865963d5614413a028b3fb3d6f19217832806d6f72f5c7f0
    • Opcode Fuzzy Hash: e1937754f0f8dc652a4ec082e13e796315af966f323772c4cdfdb1cef055ca1a
    • Instruction Fuzzy Hash: CF91C362F04F858AFB40DFA4D4403AD7366EB55BB8F806231DE2C166C9DFB89499C350
    Function 00007FF712FAC7F0 Relevance: 6.2, APIs: 4, Instructions: 158COMMON
    Download Yara Rule
    APIs
    • memmove.VCRUNTIME140 ref: 00007FF712FAC954
      • Part of subcall function 00007FF712FAE8F8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF712FA7B5F,?,?,?,?,?,?,?,?,?,00007FF712FA1347), ref: 00007FF712FAE912
    • memmove.VCRUNTIME140 ref: 00007FF712FAC941
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FAC9EE
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FAC9FB
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
    • String ID:
    • API String ID: 2075926362-0
    • Opcode ID: 68ffbc32ed889676f7ff5465ec86f0f6f5f6df4d3cc6bff6036ba88f80fc0b63
    • Instruction ID: 40713688426dc6c892bae02943674c36e3c08b14136cfa03b1bbbb567f9725fa
    • Opcode Fuzzy Hash: 68ffbc32ed889676f7ff5465ec86f0f6f5f6df4d3cc6bff6036ba88f80fc0b63
    • Instruction Fuzzy Hash: 2451E0B2B14F8A82DE44EF1695542A8A3A8F748FD0F809636DE9D07785DF7CE199C310
    Function 00007FF712FA5050 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 76e6dbf71f58cb8aa024952d63ad621d9219e4eee5aca5c58a19cf5b835a923b
    • Instruction ID: ef9aa95a32ea4568a22b41b0269f892214c7d2201820b89993da6f4bf1c5ba59
    • Opcode Fuzzy Hash: 76e6dbf71f58cb8aa024952d63ad621d9219e4eee5aca5c58a19cf5b835a923b
    • Instruction Fuzzy Hash: 94516D32B08E8186EB509F28E45437DB3A5FB84FA4F905236DA9D877A8DF78C548C710
    Function 00007FF712FAA250 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
    Download Yara Rule
    APIs
    • memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA8C89), ref: 00007FF712FAA32B
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA8C89), ref: 00007FF712FAA35F
    • memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00007FF712FA8C89), ref: 00007FF712FAA369
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FAA392
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
    • String ID:
    • API String ID: 2016347663-0
    • Opcode ID: 0faf57b97d7808d930bd55a8767bf0ce9abed128e5ca975588bc3724e35148d4
    • Instruction ID: 617e70d402d35781d1afee68e795ad04cdf6a24b22fffdd075f731d208c6caa6
    • Opcode Fuzzy Hash: 0faf57b97d7808d930bd55a8767bf0ce9abed128e5ca975588bc3724e35148d4
    • Instruction Fuzzy Hash: 5B31D261B09F4285EE50BB1691042ADE3AAEB08FF0F985631DA6D077D5DEBDE05DC220
    Function 00007FF712FA7880 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
    Download Yara Rule
    APIs
    • memmove.VCRUNTIME140(FFFFFFFF,7FFFFFFFFFFFFFFE,?,?,00007FF712FA1605), ref: 00007FF712FA78C3
    • memmove.VCRUNTIME140(FFFFFFFF,7FFFFFFFFFFFFFFE,?,?,00007FF712FA1605), ref: 00007FF712FA7989
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FA79AD
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task
    • String ID:
    • API String ID: 1247048853-0
    • Opcode ID: bf3b4f0809a4b899754c485b6c32bff3f6cac7fe83c6683a8240f9c9a99bc329
    • Instruction ID: e706a1ea8475d22e0c7b4dd0e6b4cb24bb79b149707fe70980acf4c83f6f3338
    • Opcode Fuzzy Hash: bf3b4f0809a4b899754c485b6c32bff3f6cac7fe83c6683a8240f9c9a99bc329
    • Instruction Fuzzy Hash: 3331E422B0AB4181EA58AB11A4006BDA268BF4DFF4F981730DE7E077D1CEBCE185C310
    Function 00007FF712FA7E60 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
    Download Yara Rule
    APIs
    • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF712FA7F32
      • Part of subcall function 00007FF712FAE8F8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF712FA7B5F,?,?,?,?,?,?,?,?,?,00007FF712FA1347), ref: 00007FF712FAE912
    • memmove.VCRUNTIME140 ref: 00007FF712FA7F63
    • memmove.VCRUNTIME140 ref: 00007FF712FA7F73
    • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF712FA7F96
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
    • String ID:
    • API String ID: 2075926362-0
    • Opcode ID: a0943a0ad14fa4aa678d8f9c091e7492cfd11b0b4dd48a73baee36a6094f65ef
    • Instruction ID: fc84a3ce8653f18e1c3a8654e9350cc9dd42ba454530950c390eb23b73c2aa0a
    • Opcode Fuzzy Hash: a0943a0ad14fa4aa678d8f9c091e7492cfd11b0b4dd48a73baee36a6094f65ef
    • Instruction Fuzzy Hash: 4C31E322B05B4591EA64EB12A4006ADA398EB48FF4F981731DE7E477D4DE7CE149C350
    Function 00007FF712FA79C0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: memmove$Concurrency::cancel_current_task
    • String ID:
    • API String ID: 1247048853-0
    • Opcode ID: eb24578017354564cf0405131be288cb952c9c9c76e63b1dd8142aaa5fc544e7
    • Instruction ID: ed452668fefd364cf03ae28d2c5618106d225a2b56c479d00aab47023b05d4c4
    • Opcode Fuzzy Hash: eb24578017354564cf0405131be288cb952c9c9c76e63b1dd8142aaa5fc544e7
    • Instruction Fuzzy Hash: 0E210722B0AF4655FA59BB11A90077C92489B04FF0F941B30DE2F077D2DEBCA586C320
    Function 00007FF712FAE19C Relevance: 6.1, APIs: 4, Instructions: 53COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1659680262.00007FF712FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712FA0000, based on PE: true
    • Associated: 00000000.00000002.1659665825.00007FF712FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659699986.00007FF712FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659725959.00007FF712FC2000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1659747405.00007FF712FC3000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff712fa0000_SecuriteInfo.jbxd
    Similarity
    • API ID: ByteCharErrorLastMultiWide
    • String ID:
    • API String ID: 203985260-0
    • Opcode ID: 55b0b9489396ed7e5a37b543635f95f363c1a74e51aaa4759b5b8ffd6767a4f5
    • Instruction ID: f945ba830b7f6a8f0f8c4bc8f954b204ed8103c583fc66be02560fc796068500
    • Opcode Fuzzy Hash: 55b0b9489396ed7e5a37b543635f95f363c1a74e51aaa4759b5b8ffd6767a4f5
    • Instruction Fuzzy Hash: 60214972A18B9186E3509F12E44432EBAB8F788FD0F544139DB8963B58CF7CD409CB50